Privilege Escalation Vulnerability in pac4j-oidc Affected by Token Forging

CVE-2026-82461

What is CVE-2026-82461?

The pac4j-oidc library prior to version 6.5.6 contains a significant vulnerability where it does not properly verify the signatures of access tokens, nor does it validate issuers, audiences, or expiration times. This flaw enables attackers to create forged access tokens that can impersonate administrators. Consequently, unauthorized parties can gain elevated privileges in applications that utilize pac4j's role validation against Keycloak realm and client roles, potentially allowing for exploitation and further unauthorized actions.

References