PSA: If you use pac4j for JWT authentication, you need to patch immediately, CVSS 10.0 auth bypass

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Vulnerability in pac4j-jwt Allows for Potential Authentication Bypass A vulnerability has been identified in the pac4j-jwt (JwtAuthenticator) module, which could enable attackers to bypass authentication mechanisms. This Java module is part of the pac4j security framework used for managing JSON Web Tokens (JWT) in web applications. Exploitation of this flaw poses a significant risk to applications relying on this framework for secure user authentication. 10 sources 64