Critical defect in Java security engine poses serious downstream security risks

A maximum-severity vulnerability (CVE-2026-29000) in the pac4j Java authentication engine enables authentication bypass via forged JWTs or raw JWE claims; a public proof-of-concept was published and patches have been issued. The flaw impacts many downstream frameworks (Spring Security, Play, Vert.x, Javalin, etc.), requires only access to a server's public RSA key, and poses widespread risk until downstream consumers apply fixes.