CVE-2026-40458
CSRF Token Hash Collision in PAC4J Enables Unauthorized Actions
Publication date: 2026-04-17
Last updated on: 2026-04-20
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pac4j | pac4j | From 6.0.0 (exc) to 6.4.1 (exc) |
| pac4j | pac4j | From 5.0.0 (inc) to 5.7.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
PAC4J is vulnerable to a Cross-Site Request Forgery (CSRF) attack where an attacker can create a malicious website that automatically submits a forged request with a token whose hash collides with the victim's legitimate CSRF token.
The attacker does not need to know the victim's actual CSRF token or its hash beforehand because collisions in the deterministic String.hashCode() function can be computed directly, reducing the token's security to 32 bits.
This vulnerability bypasses CSRF protection, allowing unauthorized actions such as profile updates, password changes, account linking, and other state-changing operations without the victim's consent.
How can this vulnerability impact me? :
This vulnerability can allow attackers to perform unauthorized state-changing operations on behalf of a user without their consent.
- Attackers can update user profiles.
- Attackers can change user passwords.
- Attackers can link accounts.
- Any other operations that change the state of the user's account can be performed maliciously.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade PAC4J to version 5.7.10 or later, or version 6.4.1 or later, where the issue has been fixed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in PAC4J allows an attacker to bypass CSRF protection, enabling unauthorized state-changing operations such as profile updates, password changes, and account linking without the victim's consent.
Such unauthorized actions could lead to violations of data protection and privacy regulations like GDPR and HIPAA, as they compromise the integrity and security of user data and user consent mechanisms.
However, the provided information does not explicitly discuss the impact of this vulnerability on compliance with these standards.