CVE-2026-82462: medium-severity vulnerability in pac4j
pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.2%
exploitation probability
0.2%top 91% of all CVEs
observed exploitation
nono source reports it
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
pac4j · pac4jRelated CVEs — pac4j
In the same product, most dangerous first.
CVE-2023-25581CRITICALDeserialization of untrusted data in InternalAttributeHandler in pac4jEPSS 1.9%CVE-2026-82463HIGHpac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type CheckEPSS 0.6%CVE-2026-82464MEDIUMpac4j-core before 6.5.6 Open Redirect via Backslash LogoutEPSS 0.3%CVE-2026-82461HIGHpac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access TokenEPSS 0.3%CVE-2026-82465MEDIUMpac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequestEPSS 0.3%
References
https://github.com/pac4j/pac4jhttps://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.javahttps://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237ehttps://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.htmlhttps://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-authentication-bypass-via-access-token-substitution