Pac4j Pac4j
5 CVEs affecting Pac4j Pac4j. Latest disclosed: 2026-04-17. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-40459 | High | 8.8 | 2026-04-17 | PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, pot… |
CVE-2021-44878 | High | 7.5 | 2022-01-06 | If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit c… |
CVE-2026-40458 | Medium | 6.5 | 2026-04-17 | PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will autom… |
CVE-2019-10755 | Medium | 4.9 | 2019-09-23 | The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due… |
CVE-2023-25581 | | 2024-10-10 | pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects syst… |