GHSA-xw5c-jc7x-gf75

Suggest an improvement
Source
https://github.com/advisories/GHSA-xw5c-jc7x-gf75
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xw5c-jc7x-gf75/GHSA-xw5c-jc7x-gf75.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-xw5c-jc7x-gf75
Aliases
  • CVE-2026-40458
Related
Published
2026-04-17T15:31:18Z
Modified
2026-05-05T16:12:24.627155Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
PAC4J has a Cross-Site Request Forgery (CSRF) Vulnerability
Details

PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent.

This issue was fixed in PAC4J versions 5.7.10 and 6.4.1.

Database specific 
{
    "github_reviewed": true,
    "severity": "HIGH",
    "nvd_published_at": "2026-04-17T14:16:33Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "github_reviewed_at": "2026-04-18T01:04:38Z"
}
References

Affected packages

Maven / org.pac4j:pac4j-core

Package

Name
org.pac4j:pac4j-core
View open source insights on deps.dev
Purl
pkg:maven/org.pac4j/pac4j-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.7.10

Affected versions

1.*
1.4.0
1.4.1
1.5.0
1.5.1
1.6.0-RC1
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0-RC1
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.8.8
1.8.9
1.9.0
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
1.9.7
1.9.8
1.9.9
2.*
2.0.0-RC1
2.0.0-RC2
2.0.0
2.1.0
2.2.0
2.2.1
2.3.0
2.3.1
3.*
3.0.0-RC1
3.0.0-RC2
3.0.0
3.0.1
3.0.2
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.6.0
3.6.1
3.7.0
3.8.0
3.8.1
3.8.2
3.8.3
3.9.0
4.*
4.0.0-RC1
4.0.0-RC2
4.0.0-RC3
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.2.0
4.3.0
4.3.1
4.4.0
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.5.7
4.5.8
4.5.9
4.5.10
5.*
5.0.0-RC1
5.0.0-RC2
5.0.0
5.0.1
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5
5.2.0
5.2.1
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.4.5
5.4.6
5.5.0
5.6.0
5.6.1
5.7.0
5.7.1
5.7.2
5.7.3
5.7.4
5.7.5
5.7.6
5.7.7
5.7.8
5.7.9

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xw5c-jc7x-gf75/GHSA-xw5c-jc7x-gf75.json"

Maven / org.pac4j:pac4j-core

Package

Name
org.pac4j:pac4j-core
View open source insights on deps.dev
Purl
pkg:maven/org.pac4j/pac4j-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0-RC1
Fixed
6.4.1

Affected versions

6.*
6.0.0-RC1
6.0.0-RC2
6.0.0-RC3
6.0.0-RC4
6.0.0-RC5
6.0.0-RC6
6.0.0-RC7
6.0.0-RC8
6.0.0-RC9
6.0.0-RC10
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.4.1
6.0.5
6.0.6
6.1.0
6.1.1
6.1.2
6.1.3
6.2.0
6.2.1
6.2.2
6.3.0
6.3.1
6.3.2
6.3.3
6.4.0-RC1
6.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-xw5c-jc7x-gf75/GHSA-xw5c-jc7x-gf75.json"