CVE-2026-82461
High
Description
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.
SeverityHigh
CVSS8.1
Exploit probability—
ProductPac4j
PublishedAug 29, 2026
First seenAug 29, 2026
Weakness typeCWE-347CWE-347
How to fix
Update
- pac4j pac4j6.5.6 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pac4j pac4j | v < 6.5.6 | 6.5.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.