CVE-2026-29000 Lab

Java/SparkJava lab simulating JWT/JWE authentication vulnerability related to CVE-2026-29000. The application runs on port 4567 and provides APIs to test valid login flow, forge tokens, and check dashboard.

CVE Information

CVE-2026-29000 affects pac4j-jwt in versions prior to 4.5.9, 5.7.9, and 6.3.3. The flaw is in JwtAuthenticator when processing encrypted JWT/JWE, allowing an attacker to forge authentication tokens in certain authentication flows.

Minimum recommended upgrade versions per branch:

• 4.x: upgrade to 4.5.9 or later
• 5.x: upgrade to 5.7.9 or later
• 6.x: upgrade to 6.3.3 or later

Requirements

• Docker Desktop or Docker Engine
• Docker Compose plugin
• Java 17 and Maven if running directly without Docker

Installation using Docker Compose

In the project root directory, run:

docker compose up --build

After building, open:

http://localhost:4567

Stop the lab:

docker compose down

Installation using Docker CLI

Build image:

docker build -t cve-2026-29000-lab .

Run container:

docker run --rm -p 4567:4567 --name cve-2026-29000-lab cve-2026-29000-lab

Check server public key:

curl http://localhost:4567/api/public-key

Run directly with Maven

Navigate to the lab directory:

cd lab

Run the application:

mvn exec:java

Or build first and run with classpath:

mvn -DskipTests package dependency:copy-dependencies
java -cp "target/classes;target/dependency/*" com.demo.App

On Linux/macOS, use : instead of ;:

java -cp "target/classes:target/dependency/*" com.demo.App

Basic API

• GET / - quick demo steps guide
• POST /api/login - generate a valid token
• POST /api/forge-token - generate a token for bypass demo
• GET /api/dashboard - check token in header Authorization: Bearer <token>
• GET /api/public-key - view public key in JWK format

Quick test examples

Valid login:

curl -X POST http://localhost:4567/api/login \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"user_lucas\",\"role\":\"user\"}"

Forge a token:

curl -X POST http://localhost:4567/api/forge-token \
  -H "Content-Type: application/json" \
  -d "{\"username\":\"admin\",\"role\":\"administrator\"}"

Project structure

CVE-2026-29000-lab/
|-- Dockerfile
|-- docker-compose.yml
|-- lab/
|   |-- pom.xml
|   `-- src/main/java/com/demo/
|       |-- App.java
|       `-- VulnerableAuthenticator.java
`-- README.md

Notes

This lab is for educational and testing purposes only in local environments. Do not deploy publicly or use to attack unauthorized systems.