CVE-2026-82462CWE-345

CVE-2026-82462

Medium · published August 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00195 · 8.7th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-08-29T21:17Z
References (5)
https://github.com/pac4j/pac4j · [email protected]https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.java · [email protected]https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e · [email protected]https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html · [email protected]https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-authentication-bypass-via-access-token-substitution · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 16:35Z
    pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
    cvelistv5