pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

Advisories

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

severity: high
date: 8/29/2026
Affecting: pac4j >= 0, < 6.5.6
CVE: CVE-2026-82461
CWE: CWE-347 Improper Verification of Cryptographic Signature
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: Patch Commit
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.java
https://github.com/pac4j/pac4j
Credit: Joshua Rogers (AISLE Research)
Description: pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo