A critical security flaw in the popular Java authentication library pac4j-jwt allows attackers to completely bypass authentication and impersonate any user, including administrators.
Tracked as CVE-2026-29000, this vulnerability carries a maximum CVSS score of 10.0 and requires nothing more than the server’s public RSA key to successfully exploit.​
Their automated tools and security engineers found that a remote attacker could forge a JSON Web Token (JWT) with arbitrary claims.
This completely dodges the essential signature verification process without needing access to any private keys, passwords, or shared secrets.​
The vulnerability was discovered by the CodeAnt AI Security Research Team while they were investigating open-source code patches.
How the Authentication Bypass Works
To understand the exploit, it helps to know how pac4j-jwt normally secures tokens. Standard secure deployments use two layers of defence: encryption to keep the token data private, and a cryptographic signature to prove the token is genuinely authentic.​
When the server receives a token from a user, it first decrypts the outer layer. Then, it checks the inner signature.
However, the researchers found a fatal flaw in how the system handles tokens that intentionally lack a signature altogether.
If a hacker crafts an unsigned token, technically known as a PlainJWT, and encrypts it using the server’s publicly available key, the underlying library fails to parse it as a signed object. This results in a null value during the token processing phase.​
Because of a simple, misplaced null check in the application code, the entire signature verification block is silently skipped.
Instead of rejecting the invalid token, the system simply moves forward and reads the unverified claims.
This means an attacker can write “admin” in their forged token, encrypt it with the public key, and instantly gain high-level access.
The server blindly trusts the encrypted data without ever confirming who actually created it.​
Immediate Remediation and System Patching
This severe flaw specifically impacts deployments that use RSA-encrypted tokens alongside the JwtAuthenticator configuration.
Thankfully, the open-source community moved incredibly fast to resolve the problem.
Maintainer Jérôme Leleu responded to the private disclosure immediately, confirming the issue and publishing fully working patches across multiple software versions within just two business days.​
If your application relies on pac4j-jwt, you must update your software dependencies immediately to secure your systems against this bypass.
Users on the 4.x release line need to upgrade to version 4.5.9 or newer. Those operating on the 5.x branch should update to 5.7.9 or newer. Finally, users on the 6.x line must upgrade to 6.3.3 or newer to remain safe.​
Security analysts can verify their exposure by checking their package managers for vulnerable versions.
They should also scan their application code for instances where both encryption and signature configurations are actively applied to the authenticator.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
