Pac4j vulnerabilities
We track 5 vulnerabilities in Pac4j products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 29, 2026.
Latest Pac4j vulnerabilities
- 8.1 High severity
pac4j: Incorrect Authorization
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by
- 8.1 High severity
pac4j: Improper Verification of Cryptographic Signature
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization chec
- 8.8 High severity
PAC4J: Improper Neutralization of Special Elements used in an LDAP Query
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fi
- 9.1 Critical severity
pac4j-jwt: Improper Verification of Cryptographic Signature
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key
- 9.2 Critical severity
pac4j: Deserialization of Untrusted Data
pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core.