9.3
/ 10
CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/SC:N/VI:H/SI:N/VA:N/SA:N
Description
pac4j-jwe-forge CVE-2026-29000 Proof-of-concept for CVE-2026-29000. Targets pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability is straightforward: the library accepts a PlainJWT unsigned, alg=none as long as it's wrapped inside a...
Basic Information
ID
C1584E98-D17D-541C-95E4-E1976A04C575
Published
May 3, 2026 at 07:20
Modified
May 3, 2026 at 07:24