AI Discovers Critical CVSS 10.0 Authentication Bypass in pac4j-JWT Library

CodeAnt AI Security Research has identified a critical authentication bypass, designated CVE-2026-29000, within the widely adopted Java authentication library, `pac4j-jwt`. This vulnerability has been assigned a maximum CVSS score of 10.0, indicating its severe impact and ease of exploitation. The flaw allows an attacker, possessing only the server's RSA public key—a component designed for public distribution—to forge a JSON Web Token (JWT) with arbitrary claims. This enables complete authentication bypass, permitting impersonation of any user, including administrative accounts, without requiring any secret credentials.

The discovery originated from an internal CodeAnt AI research project focused on validating the efficacy of CVE patches in popular open-source packages. Their AI code reviewer flagged an anomaly: a null check on `signedJWT` positioned directly before the signature verification block in `JwtAuthenticator.java`. This specific code arrangement created a condition where the critical signature verification process could be silently skipped, rendering the token's authenticity unchecked. A security engineer subsequently confirmed this as a true positive, revealing a complete authentication bypass.

Standard JWT authentication in `pac4j` typically employs two layers of protection: JSON Web Encryption (JWE) for confidentiality and JSON Web Signature (JWS) for integrity and authenticity. JWE encrypts the token using the server's public key, ensuring privacy in transit, while JWS signs the token, verifying its origin. Both layers are essential; encryption alone does not prove the token's legitimacy. The identified vulnerability subverts this critical two-layer defense by allowing the signature verification, which confirms authenticity, to be bypassed.

The implications are profound. Any system utilizing `pac4j-jwt` without the necessary patches is vulnerable to unauthorized access, potentially leading to data breaches, privilege escalation, and system compromise. The maintainer, Jérôme Leleu, has confirmed the vulnerability and released patches. Users are strongly advised to upgrade immediately to `pac4j-jwt` versions 4.5.9 or newer (for the 4.x line), 5.7.9 or newer (for the 5.x line), or 6.3.3 or newer (for the 6.x line). This incident underscores the vital role of AI in proactive security research and the continuous need for vigilance in software development and deployment to maintain robust security postures.

Transparency Statement: This analysis was generated by an AI model based on the provided source material. All factual claims are derived directly from the input. (EU AI Act Art. 50 Compliant)