34 matches found
cve-2026-29000
CVE-2026-29000 Exploit JWT Authentication Bypass in pac4j-jwt via JWE-wrapped PlainJWT Vulnerability Description CVE-2026-29000 is a critical authentication bypass vulnerability affecting pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability allows remote attackers to forge...
CVE-2026-29000-PoC
CVE-2026-29000 — pac4j-jwt JwtAuthenticator Authentication Bypass PoC A proof-of-concept for CVE-2026-29000 , an authentication bypass in the pac4j-jwt JwtAuthenticator component CVSS 10.0 , Critical. The script forges a token that impersonates any user with any role — without knowing a single...
CVE-2026-29000-PoC-Exploit
🚀 CVE-2026-29000 - Exploit de bypass de autenticación en pac4j-jwt CVE-2026-29000 - Forja de administrador con un clic mediante JWT alg:none + cifrado JWE 📌 Resumen Este exploit aprovecha CVE-2026-29000 , una vulnerabilidad crítica con CVSS 10.0 en la librería pac4j-jwt. Al extraer la clave...
pac4j-check
pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...
CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc
CVE-2026-29000 – pac4j JWT Authentication Bypass Python PoC Python Proof‑of‑Concept for CVE‑2026‑29000 , a critical authentication bypass affecting applications using the pac4j JWT module. The vulnerability allows attackers to authenticate as arbitrary users by sending a malicious JWE token...
CVE-2026-29000
CVE-2026-29000: Prueba de Concepto de Bypass de Autenticación JWT en pac4j Prueba de Concepto para CVE-2026-29000 - Una vulnerabilidad crítica de bypass de autenticación en la implementación JWT de pac4j que permite a atacantes falsificar tokens de administrador sin una firma válida. ⚠️ AVISO LEGA...
CVE-2026-29000
CVE-2026-29000 Lab Java/SparkJava lab simulating JWT/JWE authentication vulnerability related to CVE-2026-29000. The application runs on port 4567 and provides APIs to test valid login flow, forge tokens, and check dashboard. CVE Information CVE-2026-29000 affects pac4j-jwt in versions prior to...
CVE-2026-29000-pac4j-jwt
pac4j-jwe-forge CVE-2026-29000 Proof-of-concept for CVE-2026-29000. Targets pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability is straightforward: the library accepts a PlainJWT unsigned, alg=none as long as it's wrapped inside a valid JWE. Since the server exposes its RSA...
CVE-2026-29000
CVE-2026-29000 CVE-2026-29000: Critical Authentication Bypass in pac4j-jwt - Using Only a Public Key CVSS 10 pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 Vulnerability Summary CVE-2026-29000 is a critical authentication bypass in the pac4j-jwt library versions 6.0.3 and below. When the...
CVE-2026-29000-Lab
CVE-2026-29000 — pac4j-jwt Library-Level PoC Lab TL;DR This repository contains a library-level PoC for CVE-2026-29000 in pac4j-jwt. It compares vulnerable and patched behavior with two cases: Baseline : a legitimate token should be accepted Attack : a forged token should be accepted on vulnerabl...
CVE-2026-29000
CVE-2026-29000: pac4j-jwt Authentication Bypass POC This repository contains a proof-of-concept POC for an authentication bypass vulnerability in pac4j-jwt CVE-2026-29000. The vulnerability allows an attacker to bypass signature verification by nesting a PlainJWT using alg: none inside a JWE JSON...
CVE-2026-29000---pac4j-jwt-Authentication-Bypass-PoC
CVE-2026-29000 - pac4j-jwt Authentication Bypass PoC Note: This is not my original work. I am keeping this here for a reference. Working methodology: root@kitploit: python3 exploit.py http://IP:PORT Fetching JWKS... + Got RSA public key kid: enc-key-1 Crafted PlainJWT with sub=admin, role=ROLEADM...
CVE-2026-29000
CVE-2026-29000: pac4j-jwt JwtAuthenticator authentication bypass Full buildout: writeup, Java in-process PoC, Python token-forge CLI and library, tests. Summary CVE: CVE-2026-29000 CVSS 10, CWE-347 Affected: pac4j-jwt 4.5.9 / 5.7.9 / 6.3.3 when using JWE + signature config Issue: JWE-wrapped...
CVE-2026-29000
CVE-2026-29000 Un script de prueba de concepto para CVE-2026-29000, una vulnerabilidad crítica de omisión de autenticación encontrada en la librería pac4j-jwt AVISO LEGAL Esta prueba de concepto es solo para fines educativos y de pruebas de seguridad éticas. Fue desarrollada para demostrar la cau...
CVE-2026-29000
CVE-2026-29000 — pac4j-jwt JWE Authentication Bypass CTF lab for researching the JWE authentication vulnerability in the pac4j-jwt library CVSS 9.3 Critical · CWE-287 · Affected: pac4j-jwt ← access admin panel ↓ Read sensitive data: employee list, system config, flag Project structure...
CVE-2026-29000
CVE-2026-29000: Proof of Concept PoC for pac4j-jwt Auth Bypass ⚠️ Disclaimer This tool is for educational and ethical security testing purposes only. I do not and will not support threat acting in any way, shape or form. Use at your own risk. This is also my first PoC, so be nice please. This is...
CVE-2026-29000
CVE-2026-29000 Exploit Generator Rust This repository contains a specialized Rust implementation for exploiting CVE-2026-29000, an authentication bypass vulnerability in pac4j-jwt. The vulnerability stems from a "Signature Validation Skip" when a PlainJWT alg: none is nested within an encrypted J...
Principal-HackTheBox
HackTheBox — Principal Dificultad: Media SO: Linux Plataforma: HackTheBox Resumen Aplicación web que ejecuta pac4j-jwt v6.0.3 — vulnerable a CVE-2026-29000. La clave pública RSA está expuesta sin autenticación a través de un endpoint JWKS y puede usarse para forjar un token JWE de administrador...
pac4j-check v0.2.0
pac4j-check 离线排查 CVE-2026-29000CVSS 10.0—— 包括官方 advisory 没有列出的那些包。 English | 中文 单个 jar,约 24KB,零运行时依赖,Java 8 起可用,完全离线,不外传任何数据。 这个漏洞是什么 org.pac4j:pac4j-jwt 的 JwtAuthenticator 在处理加密 JWTJWE 时未强制校验签名。 攻击者只要拿到服务器的 RSA 公钥公钥本来就是公开的, 就能构造一个 JWE 包裹的 PlainJWT,把 subject 和 role 写成任意值, 以任意用户身份登录,包括管理员 。无需任何凭据。...
