Critical authentication bypass in the pac4j-jwt Java library

A critical vulnerability has been found in the pac4j-jwt Java authentication library, used across a range of software projects. Tracked as CVE-2026-29000, it has been assigned the maximum CVSS score of 10.0. The issue lies in the JwtAuthenticator component and its handling of encrypted JSON Web Tokens. An attacker with access to the server's public RSA key can craft a token containing arbitrary identity and role claims, including administrative accounts, bypassing authentication entirely. Fixes have been released; affected versions are releases prior to 4.5.9, 5.7.9 and 6.3.3.

What this means for your business

A public key is meant to be public, and that is exactly what makes this flaw so serious: the precondition for the attack is no secret. The attacker can sign in as administrator without stealing a single password, and the logs show a perfectly normal authenticated session. Worse, the library often arrives as a dependency inside products you bought, so you may be affected without ever having chosen pac4j.

Berigo recommends

• Search your codebase and dependency trees for pac4j-jwt and upgrade to 4.5.9, 5.7.9 or 6.3.3 or later.
• Ask your suppliers directly whether their products use pac4j, rather than assuming they would have told you.
• Review historical administrator logins for sessions with no corresponding ordinary sign-in.
• Invalidate active sessions and rotate signing keys after upgrading.

Source

• pac4j.org
• codeant.ai