CVE-2026-29000: 
Java vulnerability analysis and mitigation

CVE-2026-29000 is a critical authentication bypass vulnerability in the pac4j-jwt library's JwtAuthenticator component that allows remote, unauthenticated attackers to forge authentication tokens. Affected versions include pac4j-jwt prior to 4.5.9 (4.x branch), 5.7.9 (5.x branch), and 6.3.3 (6.x branch). The vulnerability was published on March 4, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.3 (Critical); ENISA rates it 10.0 (RedHat CVE, ENISA EUVD). IBM Cloud Pak for AIOps is among the confirmed affected downstream products (IBM Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). The JwtAuthenticator in pac4j-jwt fails to enforce signature verification when processing JWE (JSON Web Encryption)-wrapped tokens that contain an unsigned PlainJWT ("none" algorithm) as the inner payload. An attacker who possesses only the server's RSA public key — which may be publicly accessible via JWKS endpoints or embedded in client-facing configurations — can construct a JWE-wrapped PlainJWT with arbitrary sub (subject) and role claims. Because the outer JWE layer is decryptable using the public key and the inner JWT carries no signature requirement, the authenticator accepts the token as valid, granting the attacker any identity including administrator. This attack pattern maps to CAPEC-475 (Signature Spoofing by Improper Validation) (pac4j Advisory, VulnCheck Advisory, CodeAnt Research).

Successful exploitation allows a remote, unauthenticated attacker to impersonate any user — including administrators — on systems relying on pac4j-jwt for authentication. This results in complete confidentiality and integrity compromise: attackers can access protected resources, modify data, escalate privileges, and pivot laterally within the affected environment. Availability is not directly impacted by the vulnerability itself, but full administrative access enables secondary destructive actions. Downstream products such as IBM Cloud Pak for AIOps are also affected, broadening the potential blast radius across enterprise AI operations platforms (IBM Advisory, Arctic Wolf).

Multiple public proof-of-concept exploits exist. The primary PoC repository (kernelzeroday/CVE-2026-29000) contains fully functional Python and Java tools including a token_forge/ package for forging JWE-wrapped tokens, a kr_scan.py automation script for endpoint discovery, and shell scripts for executing attacks against real deployments (GitHub PoC). Additional PoC repositories have been published by multiple researchers. Exploitation has been reported across multiple threat intelligence sources, and a Nuclei detection template was submitted to ProjectDiscovery. The EPSS score is 0.00172 (low automated exploitation probability at time of scoring), but the vulnerability is not yet listed in the CISA KEV catalog. VulnCheck flagged it as routinely targeted in their May 2026 report (VulnCheck Blog). Nessus plugin 303225 provides detection coverage (Tenable).

1. Reconnaissance: Identify services using pac4j-jwt for authentication (versions < 4.5.9, < 5.7.9, or < 6.3.3) using tools like Shodan, Censys, or the kr_scan.py script from the public PoC. Look for exposed JWKS endpoints (e.g., /.well-known/jwks.json) or application configuration files that reveal the server's RSA public key.
2. Obtain RSA Public Key: Retrieve the server's RSA public key from a publicly accessible JWKS endpoint, embedded client configuration, or application source code. No private key or credentials are required.
3. Craft Malicious PlainJWT: Create an unsigned JWT (algorithm none) with arbitrary claims, e.g., {"sub": "admin", "roles": ["ADMIN"]}. This PlainJWT requires no signature.
4. Wrap in JWE: Encrypt the PlainJWT using the server's RSA public key (e.g., RSA-OAEP with AES-256-GCM) to produce a valid JWE token. The token_forge/ package in the PoC automates this step.
5. Submit Forged Token: Send the JWE-wrapped PlainJWT as a Bearer token in the Authorization header to any protected endpoint. The vulnerable JwtAuthenticator decrypts the JWE, extracts the inner PlainJWT, and accepts the arbitrary claims without signature verification.
6. Achieve Privileged Access: The server grants access as the claimed identity (e.g., administrator), enabling full control over protected resources, data exfiltration, or further lateral movement (GitHub PoC, pac4j Advisory).

• Network: Unexpected or anomalous JWT tokens in Authorization headers that, when base64-decoded, reveal a JWE structure wrapping an unsigned (alg=none) inner JWT; requests to protected endpoints from IPs with no prior authentication history.
• Logs: Application authentication logs showing successful logins for privileged accounts (e.g., admin, root) from unusual source IPs or at unusual times; absence of corresponding password-based or MFA authentication events for the same session.
• Application Behavior: Sudden privilege escalation events in application audit logs; access to administrative APIs or dashboards from accounts that have never previously accessed them.
• File System / Process: Presence of files from the PoC toolkit (kr_scan.py, forge_and_curl.sh, forge_and_kr.sh) on attacker-controlled systems if post-exploitation forensics are possible; unexpected outbound connections from application servers following authentication events.
• Token Artifacts: JWT tokens with alg: none in the inner payload header, or JWE tokens where the decrypted content is a PlainJWT — detectable via WAF rules or JWT inspection middleware (GitHub PoC, Arctic Wolf).

Upgrade pac4j-jwt to the patched versions: 4.5.9, 5.7.9, or 6.3.3 (or later within each branch). These releases enforce proper signature verification and reject unsigned PlainJWTs regardless of JWE wrapping (pac4j Advisory). As an interim workaround, restrict access to RSA public keys and JWKS endpoints to prevent attackers from obtaining the key needed to craft malicious tokens. IBM Cloud Pak for AIOps users should apply the vendor-specific patch detailed in IBM's advisory (IBM Advisory). Additionally, deploy WAF rules or JWT inspection middleware to detect and block tokens with alg: none in the inner JWT payload, and audit all downstream packages for transitive dependencies on vulnerable pac4j-jwt versions — Sonatype identified 19 additional affected packages (Sonatype Blog).

The vulnerability generated significant community discussion across Reddit (r/cybersecurity, r/devops, r/sysadmin, r/devsecops, r/blueteamsec, r/bugbounty), Hacker News, Mastodon, and Bluesky, with many practitioners highlighting the severity of an auth bypass requiring only a public key. Security vendors including Arctic Wolf, Field Effect, CIS, NCSC Ireland, and Cyble published advisories and threat digests. Sonatype's research identifying 19 additional downstream packages amplified concern about supply chain exposure (Sonatype Blog). CyberScoop covered the vulnerability as a maximum-severity risk to open-source Java ecosystems (CyberScoop). The NCSC Ireland issued a formal PDF advisory, and the CIS published a dedicated advisory (CIS Advisory). The HackTheBox "Principal" machine was built around this CVE, further driving researcher engagement (0xdf Writeup).