Pac4j Pac4j vulnerabilities

• pac4j pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest CVE-2026-82465 6.9 MediumAugust 29, 2026
• pac4j pac4j-core before 6.5.6 Open Redirect via Backslash Logout CVE-2026-82464 5.3 MediumAugust 29, 2026
• pac4j pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check CVE-2026-82463 8.6 HighAugust 29, 2026
• pac4j pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution CVE-2026-82462 6.9 MediumAugust 29, 2026
• pac4j pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token CVE-2026-82461 8.6 HighAugust 29, 2026
• pac4j LDAP Injection in PAC4J CVE-2026-40459 8.7 HighApril 17, 2026
• pac4j Cross-Site Request Forgery in PAC4J CVE-2026-40458 Fix available 7.0 HighApril 17, 2026
• pac4j pac4j-jwt pac4j-jwt JwtAuthenticator Authentication Bypass CVE-2026-29000 Public exploitFix available 9.3 CriticalMarch 4, 2026
• pac4j Deserialization of untrusted data in InternalAttributeHandler in pac4j CVE-2023-25581 Public exploitFix available 9.2 CriticalOctober 10, 2024
• pac4j Pac4j token validation bypass if OpenID Connect provider supports none algorithm CVE-2021-44878 Fix available 7.5 HighJanuary 6, 2022
• pac4j Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml CVE-2019-10755 Fix available 4.9 MediumSeptember 23, 2019