Which versions of LDAP are affected by CVE-2026-40459?

PAC4J authentication library versions 4.x, 5.x, and 6.x contain LDAP injection vulnerabilities that allow low-privileged attackers to execute arbitrary directory queries, potentially enabling…. A patch is available.

How to fix or mitigate CVE-2026-40459?

Within 24 hours: Inventory all applications using PAC4J 4.x, 5.x, or 6.x and assess LDAP integration scope. Within 7 days: Apply vendor patches-upgrade to PAC4J 4.5.10 or later (4.x line), 5.7.10 or later (5.x line), or 6.4.1 or later (6.x line). Within 30 days: Validate patches in production, review LDAP query logs for suspicious activity, and test authentication workflows to confirm functionality.

LDAP CVE-2026-40459

Q: What is the CVSS score of CVE-2026-40459?

CVE-2026-40459 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-23423 HIGH

LDAP Injection (CWE-90)

2026-04-17 CERT-PL

Authentication Bypass LDAP Code Injection

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 20, 2026 - 14:57 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 20, 2026 - 14:52 vuln.today

cvss_changed

Patch released

Apr 20, 2026 - 14:38 nvd

Patch available

Analysis Generated

Apr 17, 2026 - 16:08 vuln.today

Patch available

Apr 17, 2026 - 14:01 EUVD

EUVD ID Assigned

Apr 17, 2026 - 13:45 euvd

EUVD-2026-23423

Analysis Generated

Apr 17, 2026 - 13:45 vuln.today

CVE Published

Apr 17, 2026 - 13:18 nvd

HIGH 8.7

DescriptionCVE.org

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.

This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

AnalysisAI

LDAP injection vulnerabilities in PAC4J authentication library allow low-privileged remote attackers to execute arbitrary LDAP queries and directory operations by injecting malicious syntax into ID-based search parameters. Affects PAC4J 4.x before 4.5.10, 5.x before 5.7.10, and 6.x before 6.4.1. CVSS 8.7 (High) with network vector, low complexity, and low privilege requirement. No active exploitation confirmed per CISA KEV; EPSS score 0.22% suggests low near-term exploitation probability. Vendor patches available per pac4j.org advisory. CERT-PL reported vulnerability.

Technical ContextAI

PAC4J is a Java security framework providing authentication and authorization across multiple protocols (OAuth, SAML, CAS, LDAP, etc.). This vulnerability (CWE-90: LDAP Injection) affects the LDAP authentication module where user-supplied input in ID-based search parameters is insufficiently sanitized before constructing LDAP queries. LDAP injection allows attackers to manipulate query logic by inserting metacharacters like parentheses, asterisks, and boolean operators (e.g., transforming '(uid=USERNAME)' into '(uid=*)(|(uid=*))' to bypass filters or enumerate entries). The affected CPE (cpe:2.3:a:pac4j:pac4j) covers all PAC4J core distributions. Multiple methods are vulnerable, suggesting widespread improper input validation across LDAP query construction points in the codebase.

RemediationAI

Upgrade PAC4J to patched versions: 4.5.10 (for 4.x branch), 5.7.10 (for 5.x branch), or 6.4.1 (for 6.x branch) per vendor advisory at https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html. Patches implement proper input validation and LDAP query parameterization to prevent injection attacks. If immediate patching is infeasible, implement compensating controls: (1) Disable LDAP authentication module in PAC4J configuration and use alternative authentication mechanisms (OAuth, SAML, database) until upgrade completes - eliminates attack surface but requires application reconfiguration and user migration; (2) Deploy strict input validation at application layer before passing parameters to PAC4J LDAP methods, specifically sanitizing LDAP special characters: parentheses, asterisks, backslashes, null bytes, pipe symbols - requires code changes and thorough testing to avoid breaking legitimate usernames; (3) Restrict network access to LDAP directories using firewall rules limiting queries to authorized application servers only - reduces blast radius but does not prevent exploitation by authenticated users. Note: Workarounds provide partial risk reduction; vendor patch is the complete fix.