PT-2026-83443 · Unknown · Pac4J-Core
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
pac4j-core versions prior to 6.5.6
Description
An authentication bypass exists in the
CheckProfileTypeAuthorizer function, which reverses the profile type validation logic. This allows attackers to authenticate using a weaker client and gain access to resources that require a stronger profile type by satisfying generic profile checks.Recommendations
Update pac4j-core to version 6.5.6 or later.
Exploit
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pac4J-Core