Executive brief
pac4j-oidc is a Java security library that handles OpenID Connect authentication for web applications. Versions before 6.5.6 accept OIDC login callbacks with only an access token, bypassing required validation checks. An attacker can reuse access tokens from other applications to create fake authenticated sessions without proper verification, potentially gaining unauthorized access to protected applications.
Technical details
The vulnerability is an OIDC authentication bypass in pac4j-oidc's OidcCredentialsExtractor component. The library accepts OIDC callbacks carrying only an access token without validating the required authorization code, ID token, issuer, audience (aud), nonce, or subject. An attacker can substitute access tokens minted for other OAuth2 clients to establish authenticated sessions in the target application. The vulnerability affects versions before 6.5.6, and patches are available in version 6.5.6 and later. No authentication is required from the attacker; exploitation occurs via crafted OIDC callback requests sent to the network-reachable application.
Affected products
- pac4j pac4j-oidc before 6.5.6
Timeline
- 2026-08-29: disclosed