Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: pac4j Component: Pac4j Clear all filters
TI-2026-29211 CVE-2026-40459 · GHSA-3jrj-7493-fgq2

LDAP Injection in PAC4J

Priority MEDIUM 41

PAC4J is vulnerable to LDAP Injection in multiple methods.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00608 Published 2026-04-17 Fixed in 4.5.10, 5.7.10 +1 CWE-90
TI-2026-29210 CVE-2026-40458 · GHSA-xw5c-jc7x-gf75

Cross-Site Request Forgery in PAC4J

Priority LOW 30

PAC4J is vulnerable to Cross-Site Request Forgery (CSRF).

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00165 Published 2026-04-17 Fixed in 5.7.10, 6.4.1 CWE-352
TI-2021-20310 CVE-2021-44878 · GHSA-xhw6-hjc9-679m

If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no…

Priority LOW 35

If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type w…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00925 Published 2022-01-06 Fixed in 4.5.5, 5.3.1 CWE-347
TI-2019-08020 CVE-2019-10755 · GHSA-rc75-cf5c-mxvh

The SAML identifier generated within SAML2Utils.java was found to make use of the apache…

Priority LOW 25

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographi…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0113 Published 2019-09-23 Fixed in 3.8.2 CWE-338