Pac4j-jwt Authentication Bypass Exploit Attempt (CVE-2026-29000)
Detects attempts to exploit the authentication bypass vulnerability (CVE-2026-29000) in the pac4j-jwt library. An attacker can craft a JWE token containing an unsigned PlainJWT, which causes the library to skip signature verification. This is often indicated by a successfully authenticated token with an 'alg' (algorithm) claim of 'none'. This detection requires application logs to be configured to record the claims of successfully authenticated JWTs.
Sigma
