jake-young-dev/cve-2026-29000Proof-of-concept exploit for CVE-2026-29000, an authentication bypass in pac4j-jwt, demonstrating JWT crafting with arbitrary roles for unauthorized access.
A proof of concept script for CVE-2026-29000, a critical authentication bypass vulnerability found in the pac4j-jwt library
This Proof of Concept is for educational and ethical security testing purposes only. It was developed to demonstrate the technical root cause of CVE-2026-29000 as part of a HackTheBox laboratory environment.
Unauthorized access to computer systems is illegal. The author of this repository is not responsible for any misuse of this information or for any damage caused by the use of this script. Use this tool only on systems you own or have explicit, written permission to test. Don't be dumb.
A public endpoint exposes the RSA public key allowing us to craft a JWE-wrapped JWT with arbitrary roles, giving users full/admin-level access to apps without authentication.
If your application is vulnerable to this exploit update your pac4j-jwt dependency to versions 4.5.9+ or 5.7.9+ or 6.3.3+ and configure your JWT authenticator to avoid allowing the "none" algorithm as that is key in this bypass.
python3 cve.py <domain>