Executive brief
pac4j-core is a Java security library used to manage authentication and authorization in web applications. A flaw in its CheckProfileTypeAuthorizer component reverses the profile type validation logic, allowing attackers to bypass authentication controls by using a weaker authentication method to access resources that should require stronger authentication. This could enable unauthorized access to sensitive application features and data.
Technical details
The vulnerability exists in the CheckProfileTypeAuthorizer class in pac4j-core before version 6.5.6. The flaw is a logic error in the profile type validation check method, which uses isAssignableFrom() in reverse logic, allowing profiles that should be rejected to pass validation. An attacker can authenticate through a weaker client (e.g., basic OAuth) and then access protected resources that require a stronger profile type (e.g., SAML2) by satisfying generic profile checks. The vulnerability is an authorization bypass that does not require special preconditions beyond having a valid weak profile. The fix is available in pac4j-core 6.5.6 and later.
Affected products
- pac4j pac4j-core before 6.5.6
Timeline
- 2026-08-29: disclosed