Exploit for CVE-2026-29000

kitploit · 2026-08-29

Description

pac4j-jwt before 4.5.9/5.7.9/6.3.3 allows forged JWT/JWE tokens via JwtAuthenticator.

Entry point

ParameterAuthorization · header

Path/api/admin/dashboard

Admin-restricted endpoint accessible with forged unsigned JWT via JWE bypass.

All known vulnerabilities by product

CVSS 9.3 for CVE-2026-29000

9.3

HIGH SEVERITY

Version 4.0

VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:N/SA:N

Attack Vector:NETWORK

Attack Complexity:LOW

Attack Requirements:NONE

Privileges Required:NONE

User Interaction:NONE

EPSS Score

5.9%higher than 92.7% of all CVEs

Updated 2026-08-29

CVE Information

Exploit Details

Modified:2026-08-29 08:34

Last Seen:2026-08-29 09:17

Reporter:KitPloit

Tags

pac4j-jwtJWT forgeryJwtAuthenticatorJWE processingtoken authentication

Other exploits for CVE-2026-29000

CVE-2026-29000-PoC-Exploit

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

2026-08-28 KitPloitKITPLOIT

CVE-2026-24061-PoC-Exploit

2026-08-28 KitPloitKITPLOIT

CVE-2026-41940-PoC-Exploit

2026-08-28 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc

2026-08-27 KitPloitKITPLOIT

Exploit Code

MARKDOWN12 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-LUCASTRAN05-CVE-2026-29000
# Laboratório CVE-2026-29000

Laboratório Java/SparkJava que simula a falha de autenticação JWT/JWE relacionada à CVE-2026-29000. A aplicação roda na porta `4567` e fornece APIs para testar o fluxo de login válido, criar tokens forjados e verificar o dashboard.

## Informações da CVE

A CVE-2026-29000 afeta o `pac4j-jwt` nas versões anteriores a `4.5.9`, `5.7.9` e `6.3.3`. A falha está no `JwtAuthenticator` ao processar JWTs/JWEs criptografados, permitindo que um atacante falsifique tokens de autenticação em determinados fluxos de autenticação.

As versões mínimas para atualização dependem do branch em uso:

  * `4.x`: atualizar para `4.5.9` ou superior