CVE-2026-82461
pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 29, 2026
- Updated
- Aug 31, 2026
- Reserved
- Aug 29, 2026
Description
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
pac4jpac4j |
|
References
- Patch Commitpatch
- pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-samlvendor-advisory
- https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.javatechnical-description
- https://github.com/pac4j/pac4jproduct
- VulnCheck Advisory: pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Tokenthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.