Vulnerability in pac4j-jwt Allows for Potential Authentication Bypass

First seen 6 Mar 2026, 08:11 UTC • Gbhackers

+3 •81% similarity •63.8

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A vulnerability has been identified in the pac4j-jwt (JwtAuthenticator) module, which could enable attackers to bypass authentication mechanisms. This Java module is part of the pac4j security framework used for managing JSON Web Tokens (JWT) in web applications. Exploitation of this flaw poses a significant risk to applications relying on this framework for secure user authentication.

ThreatCluster AI

Timeline

2026-03-05

Vulnerability in pac4j-jwt announced

Recent

Security advisories issued for affected systems

Attack Flow

9 entities, 16 inferred relationships (STIX 2.1).

Technique (4)

Data Breach
Malware
Zero-day Exploit
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-29000

Affected Platform (3)

Java
Nimbus Jose+jwt
Pac4j

Tool (1)

Pac4j-jwt

Relationships

Pac4j-jwt exploits CVE-2026-29000
CVE-2026-29000 targets Java
CVE-2026-29000 targets Nimbus Jose+jwt
CVE-2026-29000 targets Pac4j
Data Breach targets Java
Data Breach targets Nimbus Jose+jwt
Data Breach targets Pac4j
Malware targets Java
Malware targets Nimbus Jose+jwt
Malware targets Pac4j
Zero-day Exploit targets Java
Zero-day Exploit targets Nimbus Jose+jwt
Zero-day Exploit targets Pac4j
T1190 - Exploit Public-Facing Application targets Java
T1190 - Exploit Public-Facing Application targets Nimbus Jose+jwt
T1190 - Exploit Public-Facing Application targets Pac4j

Community

Browse all →

Tracked Entities in This Story

Java Nimbus Jose+jwt Pac4j Data Breach Malware Zero-day Exploit Pac4j-jwt

Vulnerability in pac4j-jwt Allows for Potential Authentication Bypass

Ask AI about this cluster

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story