Pac4J
Monthly
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. No public exploit code is known and this is not listed in CISA KEV; however, the attack is low-complexity and entirely unauthenticated per the CVSS 4.0 vector.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access resources that enforce a stronger profile type requirement, due to a reversed Java class inheritance check in CheckProfileTypeAuthorizer. The single-character logical inversion - swapping the operands of isAssignableFrom - causes the authorizer to grant access when a base/generic profile is presented against a check expecting a specific subtype (e.g., SAML or OIDC profile), instead of blocking it. No public exploit has been identified at time of analysis, but the fix is confirmed in the 6.5.6 release commit alongside five other security hardening changes.
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
CSRF protection bypass in PAC4J authentication library allows remote attackers to forge state-changing requests without victim consent by exploiting hash collisions in Java's String.hashCode() function. Affects PAC4J 5.x before 5.7.10 and 6.x before 6.4.1, requiring victim interaction (visiting malicious site). EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). CERT-PL disclosed the vulnerability with vendor patches now available.
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. No public exploit code is known and this is not listed in CISA KEV; however, the attack is low-complexity and entirely unauthenticated per the CVSS 4.0 vector.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access resources that enforce a stronger profile type requirement, due to a reversed Java class inheritance check in CheckProfileTypeAuthorizer. The single-character logical inversion - swapping the operands of isAssignableFrom - causes the authorizer to grant access when a base/generic profile is presented against a check expecting a specific subtype (e.g., SAML or OIDC profile), instead of blocking it. No public exploit has been identified at time of analysis, but the fix is confirmed in the 6.5.6 release commit alongside five other security hardening changes.
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
CSRF protection bypass in PAC4J authentication library allows remote attackers to forge state-changing requests without victim consent by exploiting hash collisions in Java's String.hashCode() function. Affects PAC4J 5.x before 5.7.10 and 6.x before 6.4.1, requiring victim interaction (visiting malicious site). EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). CERT-PL disclosed the vulnerability with vendor patches now available.
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.