Critical Authentication Bypass Flaw in pac4j-jwt Exposes Systems to Full Takeover A severe vulnerability in the widely used Java authentication library pac4j-jwt (CVE-2026-29000) allows attackers to bypass authentication entirely and impersonate any user including administrators with minimal effort. The flaw, assigned a CVSS score of 10.0, was discovered by the CodeAnt AI Security Research Team during an investigation into open-source code patches. ### How the Exploit Works The vulnerability stems from a critical oversight in how the library handles unsigned JSON Web Tokens (JWTs). Normally, pac4j-jwt employs two security layers: encryption to protect token data and a cryptographic signature to verify authenticity. However, researchers found that if an attacker crafts an unsigned token (PlainJWT) and encrypts it using the server’s public RSA key, the library fails to properly validate the signature. Due to a misplaced null check in the code, the signature verification step is skipped entirely. Instead of rejecting the invalid token, the system processes the unverified claims allowing attackers to forge arbitrary identities, such as administrative access, without needing private keys or credentials. ### Affected Systems & Patching The flaw impacts deployments using RSA-encrypted tokens alongside the JwtAuthenticator configuration. The open-source community responded swiftly, with maintainer Jérôme Leleu releasing patches within two business days of disclosure. Users must upgrade to the following secure versions: - 4.x branch: 4.5.9 or newer - 5.x branch: 5.7.9 or newer - 6.x branch: 6.3.3 or newer Security teams can verify exposure by checking package managers for vulnerable versions and scanning application code for instances where both encryption and signature configurations are applied. The discovery underscores the risks of improper token validation in authentication frameworks, particularly when public-key cryptography is involved.