lucastran05/cve-2026-29000Local lab simulating CVE-2026-29000 JWT/JWE authentication bypass in pac4j-jwt. Provides login, token forging, and dashboard APIs for practicing web exploitation in a Dockerized Java/SparkJava environment.
Java/SparkJava lab simulating JWT/JWE authentication vulnerability related to CVE-2026-29000. The application runs on port 4567 and provides APIs to test valid login flow, forge tokens, and check dashboard.
CVE-2026-29000 affects pac4j-jwt in versions prior to 4.5.9, 5.7.9, and 6.3.3. The flaw is in JwtAuthenticator when processing encrypted JWT/JWE, allowing an attacker to forge authentication tokens in certain authentication flows.
Minimum recommended upgrade versions per branch:
4.x: upgrade to 4.5.9 or later5.x: upgrade to or later5.7.96.x: upgrade to 6.3.3 or laterIn the project root directory, run:
docker compose up --build
After building, open:
http://localhost:4567
Stop the lab:
docker compose down
Build image:
docker build -t cve-2026-29000-lab .
Run container:
docker run --rm -p 4567:4567 --name cve-2026-29000-lab cve-2026-29000-lab
Check server public key:
curl http://localhost:4567/api/public-key
Navigate to the lab directory:
cd lab
Run the application:
mvn exec:java
Or build first and run with classpath:
mvn -DskipTests package dependency:copy-dependencies
java -cp "target/classes;target/dependency/*" com.demo.App
On Linux/macOS, use : instead of ;:
java -cp "target/classes:target/dependency/*" com.demo.App
GET / - quick demo steps guidePOST /api/login - generate a valid tokenPOST /api/forge-token - generate a token for bypass demoGET /api/dashboard - check token in header Authorization: Bearer <token>GET /api/public-key - view public key in JWK formatValid login:
curl -X POST http://localhost:4567/api/login \
-H "Content-Type: application/json" \
-d "{\"username\":\"user_lucas\",\"role\":\"user\"}"
Forge a token:
curl -X POST http://localhost:4567/api/forge-token \
-H "Content-Type: application/json" \
-d "{\"username\":\"admin\",\"role\":\"administrator\"}"
CVE-2026-29000-lab/
|-- Dockerfile
|-- docker-compose.yml
|-- lab/
| |-- pom.xml
| `-- src/main/java/com/demo/
| |-- App.java
| `-- VulnerableAuthenticator.java
`-- README.md
This lab is for educational and testing purposes only in local environments. Do not deploy publicly or use to attack unauthorized systems.