CVE-2026-82462

medium

Description

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

References

https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-authentication-bypass-via-access-token-substitution

https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html

https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e

https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.java

https://github.com/pac4j/pac4j

Details

Source: Mitre, NVD

Published: 2026-08-29

Updated: 2026-08-29

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium