pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.

The version of Pac4J JWT installed on the remote host is affected by an authentication bypass vulnerability.

  - pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in     JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication     tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary     subject and role claims, bypassing signature verification to authenticate as any user including     administrators. (CVE-2026-29000)

The version of Pac4J JWT installed on the remote host is affected by an authentication bypass vulnerability.

  - pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in     JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication     tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary     subject and role claims, bypassing signature verification to authenticate as any user including     administrators. (CVE-2026-29000)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in
    JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication
    tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary
    subject and role claims, bypassing signature verification to authenticate as any user including
    administrators. (CVE-2026-29000)

ID	Name	Product	Family	Severity
303225	Pac4J JWT < 4.5.9 / 5.x < 5.7.9 / 6.x < 6.3.3 Authentication Bypass (CVE-2026-29000) (Direct Check)	Nessus	Web Servers	critical
303207	Pac4J JWT 4.x < 4.5.9 / 5.x < 5.7.9 / 6.x < 6.3.3 Authentication Bypass	Nessus	Misc.	critical
438449	SCA: security update for org.pac4j:pac4j-jwt (GHSA-pm7g-w2cf-q238)	Tenable Cloud Security	SCA Checks	critical
438449	SCA: security update for org.pac4j:pac4j-jwt (GHSA-pm7g-w2cf-q238)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2026-29000

critical

Tenable Plugins

critical

critical

critical

critical