Read the docs
TI-2026-56855 Aliases CVE-2026-82461GHSA-4w24-77rp-687q

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

Priority LOW 37CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Fix Fixed pac4j (pac4j): 6.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pac4jpac4jbefore 6.5.66.5.6Patch availableCNA
  • pac4j Vendorpac4j Affected before 6.5.6 Fixed in 6.5.6 Patch available CNA

Remediation

  • Fix · CNA pac4j (pac4j) Fixed in 6.5.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    pac4j — pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-56857 pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type CheckPriority MEDIUM 40
    • TI-2026-56856 pac4j-oidc before 6.5.6 Authentication Bypass via Access Token SubstitutionPriority LOW 36
    • TI-2026-56859 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequestPriority LOW 30
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82461
  2. 2026-10-03 Alias added: GHSA-4w24-77rp-687q

References

Patch 1

Advisory 1

Other 2

  • TI-2026-23172 pac4j-jwt JwtAuthenticator Authentication Bypass CVSS 4.0CRITICAL 9.3
  • TI-2023-10883 Deserialization of untrusted data in InternalAttributeHandler in pac4j CVSS 4.0CRITICAL 9.2
  • TI-2026-29211 LDAP Injection in PAC4J CVSS 4.0HIGH 8.7
  • TI-2026-56857 pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check CVSS 4.0HIGH 8.6
  • TI-2026-56856 pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution CVSS 4.0MEDIUM 6.9
  • TI-2021-20310 If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no… CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences