Cpe:2.3:a:pac4j:pac4j-Oidc:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apac4jpac4j-oidc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 29 Aug 2026 17:40:49 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in pac4j-oidc via Token Forgeryhttps://feed.craftedsignal.io/briefs/2026-08-pac4j-oidc-auth-bypass/Sat, 29 Aug 2026 17:40:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-pac4j-oidc-auth-bypass/An authorization bypass vulnerability in pac4j-oidc versions prior to 6.5.6 allows attackers to forge OIDC access tokens by exploiting the library's failure to validate token signatures, issuers, audiences, and expiration.The pac4j-oidc library, specifically versions prior to 6.5.6, contains a critical vulnerability (CVE-2026-82461) in its OpenID Connect (OIDC) implementation regarding token validation. The library fails to perform mandatory security checks on access tokens, specifically omitting the verification of cryptographic signatures, token issuers, intended audiences, and expiration timestamps. This oversight occurs specifically during the extraction of Keycloak realm and client roles. By manipulating these parameters, an attacker can craft forged access tokens containing arbitrary administrative roles. When paired with a legitimate ID token, these forged tokens permit attackers to circumvent authorization controls in any downstream application relying on pac4j-oidc for role-based access control. This flaw poses a high risk to identity-reliant architectures, as it effectively renders authentication mechanisms toothless by allowing privilege escalation via token impersonation.

Impact

Successful exploitation allows for full unauthorized access and privilege escalation within applications utilizing the affected library. This allows an attacker to operate with administrative rights without valid authentication, potentially exposing sensitive data or allowing full application takeover. All sectors deploying applications that use the pac4j-oidc library with Keycloak integration are potentially impacted.

Recommendation

  • Immediately update the pac4j-oidc library to version 6.5.6 or higher to ensure proper OIDC token validation is enforced.
  • Audit application logs for anomalous role assignments or identity claims that do not correspond to established user provisioning patterns.
  • Review all downstream services relying on pac4j-oidc for authorization to ensure that they are not accepting forged tokens due to the identified validation logic flaw.
]]>highadvisoryvulnerabilityauthentication-bypassoidcidentity-security