{"action":"Upgrade org.pac4j:pac4j-jwt to 4.5.9 (4.x), 5.7.9 (5.x) or 6.3.3 (6.x) or later.","affected":[{"fixed":"6.3.3","introduced":"6.0.4.1"},{"fixed":"5.7.9","introduced":"5.0.0-RC1"},{"fixed":"4.5.9","introduced":"0"}],"component":"org.pac4j:pac4j-jwt","cve_ids":["CVE-2026-29000"],"ecosystem":"Maven","epss":0.06088,"exploited":false,"fixed_versions":["6.3.3","5.7.9","4.5.9"],"ghsa_id":"GHSA-pm7g-w2cf-q238","id":"tcs_01M5N97Q6FSXHG48G9DZT2H9AC","modified_at":"2026-03-06T15:56:22.914018Z","published_at":"2026-03-05T00:31:11Z","references":["https://osv.dev/vulnerability/GHSA-pm7g-w2cf-q238","https://nvd.nist.gov/vuln/detail/CVE-2026-29000","https://github.com/pac4j/pac4j","https://www.codeant.ai/security-research/pac4j-jwt-authentication-bypass-public-key","https://www.pac4j.org/blog/security-advisory-pac4j-jwt-jwtauthenticator.html","https://www.vulncheck.com/advisories/pac4j-jwt-jwtauthenticator-authentication-bypass"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-pm7g-w2cf-q238","url":"https://osv.dev/vulnerability/GHSA-pm7g-w2cf-q238"}],"summary":"pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT"}