pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Pac4j Pac4j
cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*
|
— |
6.5.6
|
References 5
https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e
Patch Commit
https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java…
NVD
https://github.com/pac4j/pac4j
NVD
https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-authentication-byp…
VulnCheck Advisory: pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution