pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Pac4j Pac4j
cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*
|
— |
6.5.6
|
References 5
https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e
Patch Commit
https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java…
NVD
https://github.com/pac4j/pac4j
NVD
https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-privilege-escalati…
VulnCheck Advisory: pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token