Pac4J
Monthly
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access resources that enforce a stronger profile type requirement, due to a reversed Java class inheritance check in CheckProfileTypeAuthorizer. The single-character logical inversion - swapping the operands of isAssignableFrom - causes the authorizer to grant access when a base/generic profile is presented against a check expecting a specific subtype (e.g., SAML or OIDC profile), instead of blocking it. No public exploit has been identified at time of analysis, but the fix is confirmed in the 6.5.6 release commit alongside five other security hardening changes.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
LDAP injection vulnerabilities in PAC4J authentication library allow low-privileged remote attackers to execute arbitrary LDAP queries and directory operations by injecting malicious syntax into ID-based search parameters. Affects PAC4J 4.x before 4.5.10, 5.x before 5.7.10, and 6.x before 6.4.1. CVSS 8.7 (High) with network vector, low complexity, and low privilege requirement. No active exploitation confirmed per CISA KEV; EPSS score 0.22% suggests low near-term exploitation probability. Vendor patches available per pac4j.org advisory. CERT-PL reported vulnerability.
CSRF protection bypass in PAC4J authentication library allows remote attackers to forge state-changing requests without victim consent by exploiting hash collisions in Java's String.hashCode() function. Affects PAC4J 5.x before 5.7.10 and 6.x before 6.4.1, requiring victim interaction (visiting malicious site). EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). CERT-PL disclosed the vulnerability with vendor patches now available.
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. No public exploit code is known and this is not listed in CISA KEV; however, the attack is low-complexity and entirely unauthenticated per the CVSS 4.0 vector.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access resources that enforce a stronger profile type requirement, due to a reversed Java class inheritance check in CheckProfileTypeAuthorizer. The single-character logical inversion - swapping the operands of isAssignableFrom - causes the authorizer to grant access when a base/generic profile is presented against a check expecting a specific subtype (e.g., SAML or OIDC profile), instead of blocking it. No public exploit has been identified at time of analysis, but the fix is confirmed in the 6.5.6 release commit alongside five other security hardening changes.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
LDAP injection vulnerabilities in PAC4J authentication library allow low-privileged remote attackers to execute arbitrary LDAP queries and directory operations by injecting malicious syntax into ID-based search parameters. Affects PAC4J 4.x before 4.5.10, 5.x before 5.7.10, and 6.x before 6.4.1. CVSS 8.7 (High) with network vector, low complexity, and low privilege requirement. No active exploitation confirmed per CISA KEV; EPSS score 0.22% suggests low near-term exploitation probability. Vendor patches available per pac4j.org advisory. CERT-PL reported vulnerability.
CSRF protection bypass in PAC4J authentication library allows remote attackers to forge state-changing requests without victim consent by exploiting hash collisions in Java's String.hashCode() function. Affects PAC4J 5.x before 5.7.10 and 6.x before 6.4.1, requiring victim interaction (visiting malicious site). EPSS score of 0.02% (5th percentile) indicates very low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). CERT-PL disclosed the vulnerability with vendor patches now available.
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. No public exploit code is known and this is not listed in CISA KEV; however, the attack is low-complexity and entirely unauthenticated per the CVSS 4.0 vector.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.