pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Pac4j Pac4j
cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*
|
— |
6.5.6
|
References 5
https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e
Patch Commit
https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-core/src/main/java…
NVD
https://github.com/pac4j/pac4j
NVD
https://www.vulncheck.com/advisories/pac4j-core-before-6.5.6-authorization-bypa…
VulnCheck Advisory: pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check