Jwe — PoC Archivehttps://poc.intelseclab.com/tags/jwe/Latest proof-of-concept entries.Hugoen-usMon, 27 Jul 2026 00:00:00 +0000Apache APISIX `jwe-decrypt` Integrity-Check Bypass → Unauthenticated Gateway Auth Bypass (CVE-2026-49230)https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-49230-apisix-jwe-decrypt-auth-bypass/Mon, 27 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-27_cve-2026-49230-apisix-jwe-decrypt-auth-bypass/Critical severity (CVSS 9.1) — web · CVE-2026-49230. Status: Weaponized. Affects: Apache APISIX — jwe-decrypt auth plugin (apisix/plugins/jwe-decrypt.lua). Tags: apache-apisix, jwe, jwt, integrity-bypass, cwe-354, unauthenticated, api-gateway, lua.webCriticalapache-apisixjwejwtintegrity-bypasscwe-354unauthenticatedapi-gatewayluapac4j JWT Authentication Bypass via Unsigned Token in JWE Wrapper — CVE-2026-29000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-29000-pac4j-jwt-auth-bypass/Critical severity (CVSS 9.8) — web · CVE-2026-29000. Status: Weaponized. Affects: pac4j (JWT authentication module), used in Java web applications. Tags: pac4j, jwt, jwe, auth-bypass, alg-none, jwks, privilege-escalation, java.webCriticalpac4jjwtjweauth-bypassalg-nonejwksprivilege-escalationjava