Read the docs
TI-2026-56856 Aliases CVE-2026-82462GHSA-w9jq-4xjw-37gj

pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

Priority LOW 36CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix Fixed pac4j (pac4j): 6.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pac4jpac4jbefore 6.5.66.5.6Patch availableCNA
  • pac4j Vendorpac4j Affected before 6.5.6 Fixed in 6.5.6 Patch available CNA

Remediation

  • Fix · CNA pac4j (pac4j) Fixed in 6.5.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    pac4j — pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-56857 pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type CheckPriority MEDIUM 40
    • TI-2026-56855 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access TokenPriority LOW 37
    • TI-2026-56859 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequestPriority LOW 30
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-82462
  2. 2026-10-03 Alias added: GHSA-w9jq-4xjw-37gj

References

Patch 1

Advisory 1

Other 2

  • TI-2026-23172 pac4j-jwt JwtAuthenticator Authentication Bypass CVSS 4.0CRITICAL 9.3
  • TI-2023-10883 Deserialization of untrusted data in InternalAttributeHandler in pac4j CVSS 4.0CRITICAL 9.2
  • TI-2026-29211 LDAP Injection in PAC4J CVSS 4.0HIGH 8.7
  • TI-2026-56857 pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check CVSS 4.0HIGH 8.6
  • TI-2026-56855 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token CVSS 4.0HIGH 8.6
  • TI-2021-20310 If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no… CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences