CVE-2026-82462: pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using pac4j-oidc versions earlier than 6.5.6 are affected.
What does an attacker need to exploit this issue?
An attacker needs an OIDC callback that carries only an access token, including an access token minted for a different client. No authorization code or ID token validation is required by the affected behavior.
What validation is bypassed during exploitation?
The affected callback handling can create an authenticated session without proper verification of the token issuer, audience, nonce, or subject.
What is the available remediation?
Update pac4j-oidc to version 6.5.6 or later.