CVE-2026-82463

HighCVSS 8.1

Published: 29/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Summary

pac4j-core before version 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.

Risk Assessment

The risk includes the possibility of accessing resources with higher security requirements by authenticating through a weaker client, which could lead to confidentiality and integrity breaches.

Recommendation

It is recommended to update pac4j-core to version 6.5.6 or later, which correctly implements profile type validation logic, and to review authorization configurations.

Other vulnerabilities in pac4j-core

CVE-2026-82464Medium
pac4j-core before version 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.

Original NVD description (English source)

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.