# CVE-2026-82463: pac4j-core CheckProfileTypeAuthorizer authentication bypass

Source: https://junglewise.ai/threats/cve-2026-82463-pac4j-core-checkprofiletypeauthorizer-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82463 · Severity: high · CVSS 8.1 · Published 2026-08-29

pac4j-core is a Java security library used to manage authentication and authorization in web applications. A flaw in its CheckProfileTypeAuthorizer component reverses the profile type validation logic, allowing attackers to bypass authentication controls by using a weaker authentication method to access resources that should require stronger authentication. This could enable unauthorized access to sensitive application features and data.

Vendors: [Pac4j](https://junglewise.ai/threats/vendors/pac4j).

## Quick answers

**Is CVE-2026-82463 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82463 being exploited in the wild.

**How severe is CVE-2026-82463?** High severity, with a CVSS score of 8.1, published 29 August 2026.

**Which products and versions are affected?** Pac4j-Core before 6.5.6.

**Is there a fix for CVE-2026-82463?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82463 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82463?** Check whether you run Pac4j-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the CheckProfileTypeAuthorizer class in pac4j-core before version 6.5.6. The flaw is a logic error in the profile type validation check method, which uses isAssignableFrom() in reverse logic, allowing profiles that should be rejected to pass validation. An attacker can authenticate through a weaker client (e.g., basic OAuth) and then access protected resources that require a stronger profile type (e.g., SAML2) by satisfying generic profile checks. The vulnerability is an authorization bypass that does not require special preconditions beyond having a valid weak profile. The fix is available in pac4j-core 6.5.6 and later.

## Affected products

- pac4j pac4j-core before 6.5.6

## Timeline

- 2026-08-29: disclosed

## References

- [https://github.com/pac4j/pac4j](https://github.com/pac4j/pac4j)
- [https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-core/src/main/java/org/pac4j/core/authorization/authorizer/CheckProfileTypeAuthorizer.java](https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-core/src/main/java/org/pac4j/core/authorization/authorizer/CheckProfileTypeAuthorizer.java)

## Related threats

- [pac4j-core open redirect in logout via backslash-prefixed URL](https://junglewise.ai/threats/cve-2026-82464-pac4j-core-open-redirect-in-logout-via-backslash-prefixed-url)