Authentication Bypass via Forged Keycloak Tokens in pac4j-oidc

Executive Summary

pac4j-oidc before version 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

Useful 0 Not Useful 0

Detection Guidance

Check if your pac4j-oidc version is below 6.5.6. Review application logs for unauthorized role assignments or access token parsing failures. Inspect network traffic for unusual Keycloak token exchanges.

Useful 0 Not Useful 0

Impact Analysis

Attackers could gain unauthorized administrative access to applications using pac4j-oidc for Keycloak role validation. This could lead to privilege escalation, data breaches, or unauthorized system modifications if the forged tokens are accepted by the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. It undermines role-based access controls, potentially exposing personal or health information to unauthorized parties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade pac4j-oidc to version 6.5.6 or later. Implement strict token validation for signatures, issuers, audiences, and expiry. Review and restrict role assignments in Keycloak configurations.

Useful 0 Not Useful 0