0xw1ld/cve-2026-29000Rust-based exploit generator for CVE-2026-29000, an authentication bypass in pac4j-jwt via alg:none JWT nested in JWE, automating JWKS retrieval and token forging for authorized testing.
This repository contains a specialized Rust implementation for exploiting CVE-2026-29000, an authentication bypass vulnerability in pac4j-jwt. The vulnerability stems from a "Signature Validation Skip" when a PlainJWT (alg: none) is nested within an encrypted JWE container.
Automated JWKS Retrieval: Fetches the target's public RSA keys directly from the /api/auth/jwks endpoint.
Unsecured JWS Construction: Crafts a None algorithm JWT with administrative claims (ROLE_ADMIN).
JWE Wrapper: Encapsulates the malicious inner token using RSA-OAEP-256 and A128GCM to bypass initial perimeter filters.
Asynchronous Execution: Powered by tokio and reqwest for efficient networking.
Rust/Cargo installed.
Network access to the target (default: http://principal.htb:8080).
Installation Clone the repository:
git clone https://github.com/0xW1LD/CVE-2026-29000.git
cd CVE-2026-29000
Run the exploit generator to output the forged JWE:
cargo run
The exploit targets a logic flaw where the library decrypts the outer JWE but fails to recursively validate the signature of the inner JWS if the header specifies alg: none.
Inner Layer: A JWT with alg: None containing the admin subject.
Outer Layer: The inner JWT is encrypted using the server's own public key.
Result: The server decrypts the token, sees it was encrypted correctly, and trusts the inner payload without checking for a signature.
This tool is for educational purposes and authorized security testing (CTF/Lab environments) only. Unauthorized access to computer systems is illegal.