#VU123638 Improper verification of cryptographic signature in pac4j - CVE-2026-29000
Published: March 9, 2026 / Updated: April 1, 2026
Vulnerability identifier: #VU123638
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/U:Red
CVE-ID: CVE-2026-29000
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
pac4j
pac4j
Software vendor:
pac4j
pac4j
Description
The vulnerability allows a remote attacker to bypass authentication checks.
The vulnerability exists due to an error in JwtAuthenticator when processing encrypted JWTs. A remote non-authenticated attacker with possession of the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypass signature verification and authenticated as any user including administrators.
Remediation
Install updates from vendor's website.