CVE-2026-82462
Received Received - Intake

OIDC Access Token Validation Bypass in pac4j-oidc

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: VulnCheck

Description
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-82462
EUVD
EUVD-2026-68119

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pac4j pac4j_oidc to 6.5.6 (exc)
pac4j pac4j-oidc to 6.5.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

pac4j-oidc before version 6.5.6 has an authentication bypass vulnerability where it accepts OIDC callbacks containing only an access token without validating authorization codes or ID tokens. Attackers can replace access tokens issued for other clients to create authenticated sessions without verifying issuer, audience, nonce, or subject claims.

Detection Guidance

Check if your pac4j-oidc version is below 6.5.6. Review authentication logs for OIDC callbacks containing only access tokens without authorization codes or ID tokens. Inspect network traffic for suspicious session creation patterns.

Impact Analysis

An attacker could impersonate legitimate users by substituting access tokens, gaining unauthorized access to protected resources. This could lead to data breaches, unauthorized actions, or session hijacking in applications using vulnerable pac4j-oidc versions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance failures, regulatory penalties, and loss of trust due to potential data breaches.

Mitigation Strategies

Upgrade pac4j-oidc to version 6.5.6 or later immediately. Ensure proper validation of issuer, audience, nonce, and subject claims in OIDC tokens. Disable any configurations allowing callbacks with only access tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82462. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart