CyberRota Analysis
AI-GeneratedThe pac4j-oidc library versions prior to 6.5.6 are vulnerable due to improper verification of access token signatures, issuers, audiences, and expiry, allowing attackers to forge access tokens with administrative roles. This vulnerability enables unauthorized access to applications that rely on pac4j for role validation, potentially compromising sensitive data and functionality. Organizations using pac4j-oidc should prioritize updating to the latest version to mitigate this significant security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.