CVE-2026-82463: pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check
pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using pac4j-core before 6.5.6 are affected when CheckProfileTypeAuthorizer is used to restrict access based on a required stronger profile type.
What access does an attacker need to exploit this issue?
The attacker needs network access and low privileges. They must be able to authenticate through a weaker client while satisfying the generic profile checks used by the affected authorization path.
How can I determine whether my application is exposed?
Check whether pac4j-core is earlier than 6.5.6 and review uses of CheckProfileTypeAuthorizer. Exposure exists where that authorizer is intended to prevent users authenticated by a weaker client from accessing resources requiring a stronger profile type.
What is the available remediation?
Update pac4j-core to version 6.5.6 or later. The issue is caused by reversed profile-type validation logic in earlier versions.