Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck

CVE-2026-82462pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

Medium 6.5

In plain English

A medium-severity insufficient verification of data authenticity in pac4j from pac4j. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

Affected products (as reported)

Vendor	Product	Versions
pac4j	pac4j	0 – before 6.5.6

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Patch Commit patch
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml vendor-advisory
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.java technical-description
https://github.com/pac4j/pac4j product
VulnCheck Advisory: pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution third-party-advisory