Is UIM affected by CVE-2026-29000 ?

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

CVE‑2026‑29000 is a critical authentication bypass vulnerability affecting applications that use the pac4j‑jwt library for JWT authentication. The flaw exists in the JwtAuthenticator component when processing encrypted JSON Web Tokens (JWE), allowing attackers to bypass signature verification and forge authentication tokens using only the server’s RSA public key. Successful exploitation enables impersonation of arbitrary users, including administrative accounts.

1. The base CVSSv3.1 is rated Critical and scored at 10.
2. Successful exploitation of this vulnerability potentially allows authentication bypass in JwtAuthenticator, allowing remote attackers to forge authentication token.
3. The vulnerability affects pac4j-jwt 4.x before 4.5.9, 5.x before 5.7.9, and 6.x before 6.3.3.

CVE Details:

• CVE ID: CVE‑2026‑29000
• Severity: Critical
• CVSS v3.1 Base Score: 10.0
• CWE: CWE‑347 – Improper Verification of Cryptographic Signature
• Affected Component: pac4j‑jwt library (JwtAuthenticator)
• Vulnerability Type: Authentication Bypass

Environment

UIM 23.4.6

Resolution

CVE-2026-29000 is a vulnerability affecting the pac4j-jwt Java library, which is used for JWT-based authentication. However, UIM does not use this library for authentication, so it is not affected by this vulnerability.