CVE-2026-82461: falha de alta gravidade em pac4j
pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.3%
probabilidade de exploração
0.3%top 76% das CVEs
exploração observada
nãonenhuma fonte reporta
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pac4j · pac4jCVEs relacionadas — pac4j
No mesmo produto, das mais perigosas para as menos.
CVE-2023-25581CRITICALDeserialization of untrusted data in InternalAttributeHandler in pac4jEPSS 1.9%CVE-2026-82463HIGHpac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type CheckEPSS 0.6%CVE-2026-82464MEDIUMpac4j-core before 6.5.6 Open Redirect via Backslash LogoutEPSS 0.3%CVE-2026-82465MEDIUMpac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequestEPSS 0.3%CVE-2026-82462MEDIUMpac4j-oidc before 6.5.6 Authentication Bypass via Access Token SubstitutionEPSS 0.2%
Referências
https://github.com/pac4j/pac4jhttps://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.javahttps://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237ehttps://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.htmlhttps://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-privilege-escalation-via-unverified-keycloak-access-token