Executive brief
pac4j-oidc is a security library used in Java applications to handle user authentication and authorization via OpenID Connect providers like Keycloak. Versions before 6.5.6 fail to verify access token signatures, issuers, audiences, or expiry times when extracting user roles. An attacker can forge access tokens containing administrative roles and use them alongside valid ID tokens to bypass authorization checks and gain unauthorized access to protected resources.
Technical details
The vulnerability exists in KeycloakRolesAuthorizationGenerator, which extracts realm and client roles from JWT access tokens without cryptographic validation. The vulnerable code parses the access token via SignedJWT.parse() and directly reads claims (realm_access, resource_access) without verifying the token's signature, issuer, audience, or expiration time. An attacker can craft a forged JWT with arbitrary roles, and if presented alongside a valid ID token, the application will grant those forged roles to the user. The fix requires validating token signatures and claims before extracting role information. Patch available in version 6.5.6 and later.
Affected products
- pac4j pac4j-oidc before 6.5.6
Timeline
- 2026-08-29: disclosed
- 2026: patched: Fixed in version 6.5.6