CVE-2026-82462: falha de média gravidade em pac4j
pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.2%
probabilidade de exploração
0.2%top 91% das CVEs
exploração observada
nãonenhuma fonte reporta
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pac4j · pac4jCVEs relacionadas — pac4j
No mesmo produto, das mais perigosas para as menos.
CVE-2023-25581CRITICALDeserialization of untrusted data in InternalAttributeHandler in pac4jEPSS 1.9%CVE-2026-82463HIGHpac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type CheckEPSS 0.6%CVE-2026-82464MEDIUMpac4j-core before 6.5.6 Open Redirect via Backslash LogoutEPSS 0.3%CVE-2026-82461HIGHpac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access TokenEPSS 0.3%CVE-2026-82465MEDIUMpac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequestEPSS 0.3%
Referências
https://github.com/pac4j/pac4jhttps://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.javahttps://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237ehttps://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.htmlhttps://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-authentication-bypass-via-access-token-substitution