Lab 354 — VaultAPI — JWT Authentication Bypass via JWE-Wrapped PlainJWT

hackadvisor

Task: Enterprise API management platform using JWE-encrypted JWT tokens (RSA-OAEP-256 + A256GCM wrapping RS256-signed JWTs) with pac4j-jwt library, goal is privilege escalation to admin. Solution: Exploit CVE-2026-29000 in pac4j-jwt — wrap a PlainJWT (alg:none) with admin claims and correct issuer inside JWE encrypted with the server's public key from JWKS, bypassing signature verification entirely.