tc4dy/CVE-2026-29000-PoC-Exploit

GitHubRepository PoCExploit

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-29000 by fetching a server's RSA public key from a JWKS endpoint, forging a JWT with algorithm 'none', encrypting it into a JWE, and using it to bypass authentication and exfiltrate data from protected endpoints.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README, a Python exploit script, and a requirements file for CVE-2026-29000. The exploit performs the documented authentication bypass: it fetches a JWKS public key, forges an alg:none JWT, wraps it in a JWE, and uses it to access protected endpoints. No concealed executable behavior, unrelated payload, persistence mechanism, or operator-directed harm was observed. The script's actions are consistent with the stated exploit purpose.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwarepac4j-jwt
Attack typesAuthentication BypassToken ForgeryInformation Leakage
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, multi-stage script that actively exploits the vulnerability by forging authentication tokens and using them to access protected resources and exfiltrate data. It does not merely detect or report the vulnerability.

exploit.py:44exploit.py:365-387README.md:12

Requirements

  • Target server must expose a JWKS endpoint with an RSA public key.exploit.py:118-147
  • Target server must accept JWE tokens and be vulnerable to the 'alg: none' bypass.exploit.py:206-208

Observed behavior

  • Discovers the JWKS endpoint by probing a list of common paths.exploit.py:118-147
  • Extracts the RSA public key from the JWKS response and converts it to PEM format.exploit.py:149-191
  • Creates a JWT with algorithm 'none' and admin claims (sub: admin, role: ROLE_ADMIN, admin: true).exploit.py:193-208
  • Encrypts the forged JWT into a JWE using the server's public key.exploit.py:210-220
  • Sends the forged JWE as a Bearer token to protected endpoints to test authentication bypass.exploit.py:274-303
  • Enumerates sensitive API paths using the forged token and saves leaked responses to a file.exploit.py:305-343
  • Maintains session persistence by periodically pinging an endpoint with the forged token.exploit.py:345-358
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
JWKS discovery, RSA key extraction, alg:none JWT forging, JWE encryption, Bearer token authentication, endpoint enumeration, keep-alive loopAll observed actions directly implement the described CVE-2026-29000 authentication bypass and information gathering.exploit.py:118-147exploit.py:149-191exploit.py:193-208exploit.py:210-220exploit.py:274-303exploit.py:305-343exploit.py:345-358
Review boundaries

What the analysis did not establish

  • Two files (total 5) were omitted from the text evidence; their content is unknown.
  • The evidence was not executed; classification is based solely on static analysis of the provided source code.
  • Two unclassified files totaling 1595 bytes were present in the artifact but not analyzed; their content is unknown.
  • Only the selected commit snapshot was reviewed; other branches or tags were not examined.
  • The review is limited to static analysis of the provided text; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1