CVE-2026-82461

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-82461

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82461.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-82461

Published

2026-08-29T16:35:25Z

Modified

2026-09-12T03:30:41Z

Severity

8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

Details

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-347"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82461.json"
}

References

Affected packages

Git / github.com/pac4j/pac4j

Affected ranges

Type

GIT

Repo

https://github.com/pac4j/pac4j

Events

Introduced

Fixed

0ce4586f0526cb94d1e2bb6623c416db9b4dc2a3

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.5.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

6.*

6.0.4.1

pac4j-1.*

pac4j-1.4.0

pac4j-1.4.1

pac4j-1.5.0

pac4j-1.5.1

pac4j-1.6.0

pac4j-1.6.0-RC1

pac4j-1.7.0

pac4j-1.8.0

pac4j-1.8.0-RC1

pac4j-1.8.1

pac4j-1.8.2

pac4j-1.8.3

pac4j-1.9.0

pac4j-1.9.1

pac4j-1.9.2

pac4j-1.9.3

pac4j-2.*

pac4j-2.0.0

pac4j-2.0.0-RC1

pac4j-2.0.0-RC2

pac4j-2.1.0

pac4j-3.*

pac4j-3.0.0

pac4j-3.0.0-RC1

pac4j-3.0.0-RC2

pac4j-3.0.1

pac4j-3.1.0

pac4j-3.2.0

pac4j-3.3.0

pac4j-3.4.0

pac4j-4.*

pac4j-4.0.0

pac4j-4.0.0-RC1

pac4j-4.0.0-RC2

pac4j-4.0.0-RC3

pac4j-4.0.1

pac4j-4.0.2

pac4j-4.0.3

pac4j-4.1.0

pac4j-5.*

pac4j-5.0.0

pac4j-5.0.0-RC1

pac4j-5.0.0-RC2

pac4j-5.0.1

pac4j-5.1.0

pac4j-5.1.1

pac4j-5.1.2

pac4j-5.1.3

pac4j-5.1.4

pac4j-5.1.5

pac4j-parent-5.*

pac4j-parent-5.2.0

pac4j-parent-5.2.1

pac4j-parent-5.3.0

pac4j-parent-5.3.1

pac4j-parent-5.4.0

pac4j-parent-5.4.2

pac4j-parent-5.4.3

pac4j-parent-5.4.4

pac4j-parent-5.4.5

pac4j-parent-5.4.6

pac4j-parent-5.5.0

pac4j-parent-5.6.0

pac4j-parent-5.6.1

pac4j-parent-5.7.0

pac4j-parent-6.*

pac4j-parent-6.0.0

pac4j-parent-6.0.0-RC1

pac4j-parent-6.0.0-RC10

pac4j-parent-6.0.0-RC2

pac4j-parent-6.0.0-RC3

pac4j-parent-6.0.0-RC4

pac4j-parent-6.0.0-RC5

pac4j-parent-6.0.0-RC6

pac4j-parent-6.0.0-RC7

pac4j-parent-6.0.0-RC8

pac4j-parent-6.0.0-RC9

pac4j-parent-6.0.1

pac4j-parent-6.0.2

pac4j-parent-6.0.3

pac4j-parent-6.0.4

pac4j-parent-6.0.5

pac4j-parent-6.0.6

pac4j-parent-6.1.0

pac4j-parent-6.1.1

pac4j-parent-6.1.2

pac4j-parent-6.1.3

pac4j-parent-6.2.0

pac4j-parent-6.2.1

pac4j-parent-6.2.2

pac4j-parent-6.3.0

pac4j-parent-6.3.1

pac4j-parent-6.3.2

pac4j-parent-6.4.0

pac4j-parent-6.4.0-RC1

pac4j-parent-6.4.1

pac4j-parent-6.5.0

pac4j-parent-6.5.1

pac4j-parent-6.5.2

pac4j-parent-6.5.3

pac4j-parent-6.5.4

pac4j-parent-6.5.5

scribe-up-1.*

scribe-up-1.0.0

scribe-up-1.1.0

scribe-up-1.3.0

scribe-up-1.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82461.json"