otuva/cve-2026-29000Proof-of-concept exploit for CVE-2026-29000, an authentication bypass in pac4j-jwt via nested PlainJWT with alg:none inside a JWE container.
This repository contains a proof-of-concept (POC) for an authentication bypass vulnerability in pac4j-jwt (CVE-2026-29000). The vulnerability allows an attacker to bypass signature verification by nesting a PlainJWT (using alg: none) inside a JWE (JSON Web Encryption) container.
The attack works by exploiting the server's willingness to decrypt a JWE encrypted with its public key and subsequently trust the inner JWT without validating its signature, provided it uses the none algorithm.
Ensure you have Python 3 installed along with the required dependencies:
pip install requests jwcrypto
Use exp.py to fetch the target's public key from the JWKS endpoint, craft a malicious token with ROLE_ADMIN privileges, and wrap it in a JWE.
python3 exp.py <TARGET_URL> --user admin --role ROLE_ADMIN
Example:
python3 exp.py http://localhost:8080
Once you have the forged token, use app.py to interact with protected API endpoints.
python3 app.py <TARGET_URL> <FORGED_TOKEN>
Test a specific endpoint:
python3 app.py http://localhost:8080 <FORGED_TOKEN> --endpoint /api/users
exp.py: The main exploit script that fetches JWKS, crafts a PlainJWT, and forges a JWE.app.py: A utility script to test the forged token against discovered API endpoints (/api/dashboard, /api/users, /api/settings).This POC is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal.