yasirr10/cve-2026-29000Exploit for CVE-2026-29000, an authentication bypass in pac4j-jwt allowing attackers to forge admin tokens using only the public key.
CVE-2026-29000: Critical Authentication Bypass in pac4j-jwt - Using Only a Public Key (CVSS 10)
pac4j-jwt Authentication Bypass Exploit (CVE-2026-29000) Vulnerability Summary CVE-2026-29000 is a critical authentication bypass in the pac4j-jwt library (versions 6.0.3 and below). When the application uses JWE (encrypted JWT) with inner JWS signature verification, the library fails to properly handle an unsigned PlainJWT (alg: "none") inside the JWE envelope. This allows an attacker to forge a valid admin token using only the public key from the /jwks endpoint. Impact: Full authentication bypass — attacker can impersonate any user (including admin). How to Use the Exploit
Step 1:- python3 exploit.py
Step 2:- Enter target Base URL
Step 3:- Enter JWKS Public Key URL
The script will: Fetch the RSA public key Forge an admin token (ROLE_ADMIN) Print the token Save it to forged_token.txt
Use the token:Bashcurl -H "Authorization: Bearer $(cat forged_token.txt)" http://target/api/dashboard
References: https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key
CVE-2026-29000 Affected Library: pac4j-jwt ≤ 6.0.3
