# CVE-2026-82461: pac4j pac4j-oidc access token validation bypass in Keycloak roles

Source: https://junglewise.ai/threats/cve-2026-82461-pac4j-pac4j-oidc-access-token-validation-bypass-in-keycloak-roles  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82461 · Severity: high · CVSS 8.1 · Published 2026-08-29

pac4j-oidc is a security library used in Java applications to handle user authentication and authorization via OpenID Connect providers like Keycloak. Versions before 6.5.6 fail to verify access token signatures, issuers, audiences, or expiry times when extracting user roles. An attacker can forge access tokens containing administrative roles and use them alongside valid ID tokens to bypass authorization checks and gain unauthorized access to protected resources.

Vendors: [Pac4j](https://junglewise.ai/threats/vendors/pac4j).

## Quick answers

**Is CVE-2026-82461 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82461 being exploited in the wild.

**How severe is CVE-2026-82461?** High severity, with a CVSS score of 8.1, published 29 August 2026.

**Which products and versions are affected?** Pac4j-Oidc before 6.5.6.

**Is there a fix for CVE-2026-82461?** A patch was published on 2026: Fixed in version 6.5.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82461 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82461?** Check whether you run Pac4j-Oidc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in KeycloakRolesAuthorizationGenerator, which extracts realm and client roles from JWT access tokens without cryptographic validation. The vulnerable code parses the access token via SignedJWT.parse() and directly reads claims (realm_access, resource_access) without verifying the token's signature, issuer, audience, or expiration time. An attacker can craft a forged JWT with arbitrary roles, and if presented alongside a valid ID token, the application will grant those forged roles to the user. The fix requires validating token signatures and claims before extracting role information. Patch available in version 6.5.6 and later.

## Affected products

- pac4j pac4j-oidc before 6.5.6

## Timeline

- 2026-08-29: disclosed
- 2026: patched: Fixed in version 6.5.6

## References

- [https://github.com/pac4j/pac4j](https://github.com/pac4j/pac4j)
- [https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.java](https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.java)

## Related threats

- [pac4j pac4j-oidc authentication bypass](https://junglewise.ai/threats/cve-2026-82462-pac4j-pac4j-oidc-authentication-bypass)