CVE-2026-82461

HIGH 8.1

pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

CWE	CWE-347
Vendor	pac4j
Product	pac4j
Published	Aug 29, 2026

Stay Ahead of the Next One

Get instant alerts for pac4j pac4j

Be the first to know when new high vulnerabilities affecting pac4j pac4j are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

pac4j / pac4j

0 < 6.5.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e pac4j.org: https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html github.com: https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.java github.com: https://github.com/pac4j/pac4j vulncheck.com: https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-privilege-escalation-via-unverified-keycloak-access-token

Credits

Joshua Rogers (AISLE Research)