cipher1x1/cve-2026-29000Proof-of-concept exploit for CVE-2026-29000, an authentication bypass in pac4j-jwt via JWE-wrapped unsigned JWT, enabling privilege escalation.
This tool is for educational and ethical security testing purposes only. I do not and will not support threat acting in any way, shape or form. Use at your own risk.
CVE-2026-29000 is a critical vulnerability (CVSS 10.0) in the pac4j-jwt library. It stems from improper validation logic in the JwtAuthenticator when handling nested (encrypted) tokens.
The flaw exists because while pac4j correctly decrypts a JWE (JSON Web Encryption) token using the server's key, it fails to enforce signature verification on the inner JWT. This allows an attacker to wrap an unsigned JWT (using {"alg": "none"}) inside a valid JWE wrapper. The server decrypts the JWE, trusts the inner payload, and grants access.
pac4j versions prior to 4.5.9, 5.7.9, and 6.3.3.ROLE_ADMIN).The provided script, CVE-2026-29000.py, automates the following steps:
/api/auth/jwks endpoint.alg: none and administrative claims.Ensure you have the required Python libraries installed:
pip install requests jwcrypto
python3 CVE-2026-29000.py <TARGET_URL>
Example:
python3 CVE-2026-29000.py http://vulnerable-app.local:8080
To mitigate this vulnerability, take the following actions:
pac4j-jwt to version 4.5.9, 5.7.9, or 6.3.3 (or higher) immediately.JwtAuthenticator configuration explicitly requires a valid signature and does not permit the none algorithm.Created by: Cipher1x1