Read the docs

pac4j

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

pac4j records in CISA KEV

No pac4j vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Pac4j 4 records MEDIUM

Records

4 records in Pac4j · all components

TI-2026-29211 CVE-2026-40459 · GHSA-3jrj-7493-fgq2

LDAP Injection in PAC4J

Priority MEDIUM 41

PAC4J is vulnerable to LDAP Injection in multiple methods.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00608 Published 2026-04-17 Fixed in 4.5.10, 5.7.10 +1 CWE-90
TI-2021-20310 CVE-2021-44878 · GHSA-xhw6-hjc9-679m

If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no…

Priority LOW 35

If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type w…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00925 Published 2022-01-06 Fixed in 4.5.5, 5.3.1 CWE-347
TI-2026-29210 CVE-2026-40458 · GHSA-xw5c-jc7x-gf75

Cross-Site Request Forgery in PAC4J

Priority LOW 30

PAC4J is vulnerable to Cross-Site Request Forgery (CSRF).

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00165 Published 2026-04-17 Fixed in 5.7.10, 6.4.1 CWE-352
TI-2019-08020 CVE-2019-10755 · GHSA-rc75-cf5c-mxvh

The SAML identifier generated within SAML2Utils.java was found to make use of the apache…

Priority LOW 25

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographi…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0113 Published 2019-09-23 Fixed in 3.8.2 CWE-338
Open these records in search →