Vulnerability Description
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/pac4j/pac4j
- https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/
- https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e
- https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html
- https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-privilege-escalatio
FAQ
What is CVE-2026-82461?
CVE-2026-82461 is a vulnerability with a CVSS score of 8.1 (HIGH). pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative ro...
How severe is CVE-2026-82461?
CVE-2026-82461 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82461?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.