CVE-2026-82461: pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
Published Aug 29, 2026
·Updated
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.
Affected Software
1 affected component
pac4j-oidc<6.5.6
Event History
Aug 29, 2026
CVE Published
via MITRE·04:35 PM
Data Sourced
via MITRE·04:35 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Applications using pac4j-oidc versions before 6.5.6 are exposed when they rely on pac4j role validation using Keycloak realm or client roles.
2
What must an attacker provide to bypass authorization?
An attacker needs a valid ID token paired with a forged access token that claims administrative roles. The affected component does not verify the access token's signature, issuer, audience, or expiration when extracting those roles.