Loading story…
A maximum-severity authentication bypass was disclosed in pac4j’s JWT component (pac4j-jwt), tracked as CVE-2026-29000, affecting a widely used Java security engine embedded across many downstream software packages. The issue is a logic flaw that enables attackers to bypass authentication controls by crafting tokens/claims in a way that defeats expected verification, raising concern because exploitation can be relatively straightforward and the library’s transitive use complicates exposure tracking and patch rollout across dependent applications.
Public proof-of-concept (PoC) code is available, and reporting indicates an attacker who can obtain a target server’s RSA public key (often publicly accessible) can forge a JWE-wrapped PlainJWT containing arbitrary sub and role claims to bypass signature verification and authenticate as any user, including administrators. The pac4j maintainer disclosed the defect and released patched versions shortly after private reporting; while there were no confirmed in-the-wild exploits at the time of reporting, defenders should expect downstream vendors and application owners to issue their own advisories and updates as they assess inherited risk from bundled pac4j versions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
F5 issued a product advisory for CVE-2026-29000, indicating the pac4j vulnerability affected or was relevant to F5 products. This marks a downstream vendor response following the earlier pac4j disclosure and patching activity.
CodeAnt AI said it contacted hundreds of maintainers whose repositories may depend on vulnerable pac4j components. Researchers also warned that downstream projects may need to publish their own advisories and patches.
CyberScoop reported that CVE-2026-29000 had been publicly disclosed after CodeAnt AI published a proof-of-concept exploit, warning that the pre-authentication flaw was easy to reproduce with only a server's public RSA key. The report highlighted serious downstream risk because pac4j is embedded in frameworks such as Spring Security, Play Framework, Vert.x, and Javalin.
HKCERT published a security bulletin warning of a pac4j-jwt security restriction bypass vulnerability. The advisory marked broader public disclosure of the issue to defenders and users.
Within two days of the private report, the pac4j maintainer disclosed the vulnerability and issued fixes for affected pac4j versions. The flaw affected the pac4j authentication component used across multiple Java frameworks and downstream projects.
CodeAnt AI discovered a critical logic flaw in pac4j-jwt, later assigned CVE-2026-29000, that could let attackers bypass authentication by forging JWTs or abusing raw JSON claims via JWE. The issue was privately disclosed to the pac4j maintainer before public announcement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
my.f5.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcehkcert.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026
A critical vulnerability in **Postiz** allows any authenticated user to escalate privileges to **SUPERADMIN** by forging JWTs through the application's **Skool integration callback**. Tracked as **`CVE-2026-48781`** and **`GHSA-j77w-h625-56q2`**, the flaw stems from attacker-controlled JSON being signed into a session-like token with the application's `JWT_SECRET`, while authentication logic trusted the token's claims without reloading the user record from the database. The bug affects Postiz versions prior to **`2.21.8`** and enables cross-tenant takeover, arbitrary organization impersonation, full access across the affected instance, exposure of all registered users, and the ability to post through victims' connected social media accounts. The issue is rated **CVSS 9.9 (Critical)**, was verified and patched by the vendor, and defenders are advised to upgrade to **`2.21.8`**, rotate JWT secrets if compromise is suspected, and review logs for impersonation or unauthorized access activity.
Jul 12, 2026
Researchers disclosed critical pre-authentication remote code execution flaws in **ForgeRock/OpenAM** that let attackers execute code without logging in by abusing unsafe Java deserialization in request parameters. PortSwigger reported `CVE-2021-35464` in ForgeRock OpenAM, while later research detailed `CVE-2026-33439` in OpenIdentityPlatform OpenAM, where attacker-controlled data in the `jato.clientSession` parameter could reach `ApplicationObjectInputStream.readObject()` without class filtering. The newer flaw affected unauthenticated password-reset endpoints including `/openam/ui/PWResetUserValidation` and `/openam/ui/PWResetQuestion`, where JSP processing of `<jato:form>` tags exposed the vulnerable code path. Researchers said a crafted gadget chain could achieve code execution with a single `GET` request on OpenAM `16.0.5`, and that version `16.0.6` fixed the issue by routing `Encoder.deserialize()` through the same whitelist-based deserialization protections previously applied to `jato.pageSession`; the bug was assigned **CVSS 9.8** and mapped to `CWE-502`.
Jul 23, 2026