{"id":"CVE-2026-82462","summary":"pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution","details":"pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.","modified":"2026-10-28T11:18:14.608351164Z","published":"2026-08-29T16:35:26.177Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82462.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-345"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82462.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82462"},{"type":"ADVISORY","url":"https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-authentication-bypass-via-access-token-substitution"},{"type":"FIX","url":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e"},{"type":"PACKAGE","url":"https://github.com/pac4j/pac4j"},{"type":"ARTICLE","url":"https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.java"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pac4j/pac4j","events":[{"introduced":"0"},{"fixed":"0ce4586f0526cb94d1e2bb6623c416db9b4dc2a3"},{"fixed":"2270c3ff70e93cc43831e75702acd5135531237e"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"fixed":"6.5.6"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"2270c3ff70e93cc43831e75702acd5135531237e"}]}]}}],"versions":["pac4j-parent-6.5.5","pac4j-parent-6.5.4","pac4j-parent-6.5.3","pac4j-parent-6.5.2","pac4j-parent-6.5.1","pac4j-parent-6.5.0","pac4j-parent-6.4.1","pac4j-parent-6.4.0","pac4j-parent-6.4.0-RC1","pac4j-parent-6.3.2","pac4j-parent-6.3.1","pac4j-parent-6.3.0","pac4j-parent-6.2.2","pac4j-parent-6.2.1","pac4j-parent-6.2.0","pac4j-parent-6.1.3","pac4j-parent-6.1.2","pac4j-parent-6.1.1","pac4j-parent-6.1.0","pac4j-parent-6.0.6","pac4j-parent-6.0.5","6.0.4.1","pac4j-parent-6.0.4","pac4j-parent-6.0.3","pac4j-parent-6.0.2","pac4j-parent-6.0.1","pac4j-parent-6.0.0","pac4j-parent-6.0.0-RC10","pac4j-parent-6.0.0-RC9","pac4j-parent-6.0.0-RC8","pac4j-parent-6.0.0-RC7","pac4j-parent-6.0.0-RC6","pac4j-parent-6.0.0-RC5","pac4j-parent-6.0.0-RC4","pac4j-parent-6.0.0-RC3","pac4j-parent-6.0.0-RC2","pac4j-parent-6.0.0-RC1","pac4j-parent-5.7.0","pac4j-parent-5.6.1","pac4j-parent-5.6.0","pac4j-parent-5.5.0","pac4j-parent-5.4.6","pac4j-parent-5.4.5","pac4j-parent-5.4.4","pac4j-parent-5.4.3","pac4j-parent-5.4.2","pac4j-parent-5.4.0","pac4j-parent-5.3.1","pac4j-parent-5.3.0","pac4j-parent-5.2.1","pac4j-parent-5.2.0","pac4j-5.1.5","pac4j-5.1.4","pac4j-5.1.3","pac4j-5.1.2","pac4j-5.1.1","pac4j-5.1.0","pac4j-5.0.1","pac4j-5.0.0","pac4j-5.0.0-RC2","pac4j-5.0.0-RC1","pac4j-4.1.0","pac4j-4.0.3","pac4j-4.0.2","pac4j-4.0.1","pac4j-4.0.0","pac4j-4.0.0-RC3","pac4j-4.0.0-RC2","pac4j-4.0.0-RC1","pac4j-3.4.0","pac4j-3.3.0","pac4j-3.2.0","pac4j-3.1.0","pac4j-3.0.1","pac4j-3.0.0","pac4j-3.0.0-RC2","pac4j-3.0.0-RC1","pac4j-2.1.0","pac4j-2.0.0","pac4j-2.0.0-RC2","pac4j-2.0.0-RC1","pac4j-1.9.3","pac4j-1.9.2","pac4j-1.9.1","pac4j-1.9.0","pac4j-1.8.3","pac4j-1.8.2","pac4j-1.8.1","pac4j-1.8.0","pac4j-1.8.0-RC1","pac4j-1.7.0","pac4j-1.6.0","pac4j-1.6.0-RC1","pac4j-1.5.1","pac4j-1.5.0","pac4j-1.4.1","pac4j-1.4.0","scribe-up-1.3.1","scribe-up-1.3.0","scribe-up-1.1.0","scribe-up-1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82462.json","vanir_signatures":[{"source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-core/src/main/java/org/pac4j/core/authorization/authorizer/CheckProfileTypeAuthorizer.java"},"deprecated":false,"digest":{"line_hashes":["45862916066931846232508731134300554558","192641031987256361857487904475918497776","277616411297623625976638330663806413076","244878319972229220276926254101178201607"],"threshold":0.9},"id":"CVE-2026-82462-03bb1bab","signature_type":"Line","signature_version":"v1"},{"target":{"file":"pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.java","function":"extract"},"deprecated":false,"digest":{"length":3865,"function_hash":"320624739129712806779648112720539268998"},"id":"CVE-2026-82462-0c176222","signature_type":"Function","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["89060110334654959951422547391683207355","141699734265908255338258935213398113736","178691016925412356802978545888238882498","276101439019335112732791023953082242912","28584731659026407587248267412404691982","37136625157311655657869201617804554075","2919854412115925527618877684041948013","227258526329944692148646005848092229700","309954283549443431439735914638798189195","195737620503008558157327741732000372298","24632362239560868886280237564645907169","93944708470492620537744440750337324424","315954463597552908487519071672077683744","65989705905703731253972768680118397555","329854489494559818752540703487515021864","71634560185079633099367866488327808639","91596066806200108365429321207892148135"]},"id":"CVE-2026-82462-0d5f0e0b","signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/test/java/org/pac4j/oidc/profile/creator/OidcProfileCreatorTests.java"}},{"signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/main/java/org/pac4j/oidc/profile/creator/OidcProfileCreator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["227420358905129551732976530781137565072","267714441580131219788917424176164664728","95358179134275289788121414141337243000","66315220076602782398379152878825568352","7608950127692638637734377152520882801","224827708556392157142823239392791070199"]},"id":"CVE-2026-82462-100622bc","signature_type":"Line"},{"target":{"file":"pac4j-core/src/main/java/org/pac4j/core/util/Pac4jConstants.java"},"deprecated":false,"digest":{"line_hashes":["49553482304851035009222814337849507293","102926942792442235859200937830496593769","108429406809676851863418112206454751351","142359976117244989181092556311342807084"],"threshold":0.9},"id":"CVE-2026-82462-1316dc5b","signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e"},{"signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/test/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractorTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["84100701313786188906706614774327971183","231812617997758547877560685314064430245","47341353105651654561190750222731347461","219748641471000359091926817789286234750","110716029955338572547168736136804634612","321281638583297528370474227035802042168","49770134070007567983849402340482735910"]},"id":"CVE-2026-82462-18155a52","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["100098834256447686251708189764698383052","337143072649394021524762666158794390618","14092773566054822235398802143368775318","177169640358984683879298794752839703731","169437176054043340165417060202777437010"],"threshold":0.9},"id":"CVE-2026-82462-19dd2f5c","signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/main/java/org/pac4j/oidc/client/KeycloakOidcClient.java"},"deprecated":false,"digest":{"line_hashes":["135671822268075651679941617794163672094","172324417050217489740065508607497305893","331372752889901533798498490228240696103","66488145189856885891828553830099312602"],"threshold":0.9},"id":"CVE-2026-82462-2cb6c286"},{"target":{"file":"pac4j-oauth/src/main/java/org/pac4j/oauth/redirect/OAuth20RedirectionActionBuilder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["154673807264724242715312819652788429955","130910038096700958025994215166399134177","305710399670746024458084709225202583196","264959987073148675395154006113704172585","231407665601119311443397300781083191761","194158359276538717279345563085848746667","188467186069472280550431606523741751683","138269401407852903952887751367683354461","245132191805711944305193112650251679135","335648864511163959573972730666808108036","184982054317189170930486722796328349455","219760681520796717366044240826103618424"]},"id":"CVE-2026-82462-3fd52826","signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["3035760613877720370672328517838384066","180119253324081980367810195592798083505","40154969385739635767528372135752349638","142942464458454157599556922245102383878","205460426565543654212636292218680690072","273822464464505550033680286178928050753","249880926718105172742969679912237109770","328308492442736453321649950462690549486","299870117550911874347849229311580517085","260817998895482343042300624659350108203","9350626600774093639759776927070472652","325379927369112034375641851838529282025","5696844016635520750734058763556072902","246475059477131747511592095441328211677","79529895259426244620580205396194812140","20162668875319567532174616737894852158","8961827571305532390723010175708735030","10850918568568364784496651292024042840","30090046324587856493087554855212150010","274076042059677797592819223571435370497","109662921429485479312407450814176467079","23801717612344310554343123789479150102","166330759804826465288707922097394038733","299212842380467814021939978108255830155","31992230081641573565558655720600915685","182665407605589487310462347422772311487","59987546487103530724934640493993396574"]},"id":"CVE-2026-82462-43bd8fcc"},{"digest":{"function_hash":"162007985159943239077581111693160654539","length":804},"id":"CVE-2026-82462-445285e7","signature_type":"Function","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-saml/src/main/java/org/pac4j/saml/logout/impl/SAML2LogoutValidator.java","function":"validateLogoutRequest"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/main/java/org/pac4j/oidc/profile/creator/OidcProfileCreator.java","function":"callUserInfoEndpoint"},"deprecated":false,"digest":{"function_hash":"116690505676153936339762931012202240097","length":1331},"id":"CVE-2026-82462-5758b525","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-core/src/main/java/org/pac4j/core/engine/DefaultLogoutLogic.java"},"deprecated":false,"digest":{"line_hashes":["214112367194989518933451126687903392544","147742948428505302004794297127092016505","193204728481585529166986324850451551814","215208330505530354087537822541205454843","284696649399569342936126596898559605720","134537884811236103138211614976317515786","271892017452592505197176825888638418900"],"threshold":0.9},"id":"CVE-2026-82462-57658738"},{"id":"CVE-2026-82462-62705d1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"function":"internalInit","file":"pac4j-oidc/src/main/java/org/pac4j/oidc/client/KeycloakOidcClient.java"},"deprecated":false,"digest":{"function_hash":"96354511285632692718808117754166588173","length":259}},{"signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-core/src/main/java/org/pac4j/core/authorization/authorizer/CheckProfileTypeAuthorizer.java","function":"check"},"deprecated":false,"digest":{"function_hash":"176103237225689501752710107875090714721","length":151},"id":"CVE-2026-82462-6d2dceb6","signature_type":"Function"},{"digest":{"line_hashes":["208651850395400298663534533252427685187","326498875917585322966944156008442519858","122414855987269928511492267725615323870","153321011648289519002769353892829810894","40042627090193748098968855797326824414","240884691276854767425672146753631737873","237650164338603164527630193175390742565","314568808917708478430627525402426266255","170834801688532640978320708059074641644","145215499854233937210769601791947924838","184552686712296936330213686854929545658","270202981743503411300380499302839250005","325613967373604067647699568491419039037","69512360716601281151361379196914599344"],"threshold":0.9},"id":"CVE-2026-82462-7ba0e8c4","signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-saml/src/test/java/org/pac4j/saml/logout/impl/SAML2LogoutValidatorTests.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["231237698326085137870134448205933526061","217675926220789372254408002409072257202","67111863079384407167944269538653864684","47428095683439861804944607963548729426","277907775286143455918358056392780694658","220767143300325457751955262366262907753","284659869867827712620857737064887259977","272440195277911677777605077358428461906"],"threshold":0.9},"id":"CVE-2026-82462-894e9ac9","signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-core/src/test/java/org/pac4j/core/engine/DefaultLogoutLogicTests.java"}},{"id":"CVE-2026-82462-89becbbd","signature_type":"Function","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/test/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGeneratorTests.java","function":"test"},"deprecated":false,"digest":{"function_hash":"101737993053106548734738913576954020926","length":280}},{"signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"function":"getRedirectionAction","file":"pac4j-oauth/src/main/java/org/pac4j/oauth/redirect/OAuth20RedirectionActionBuilder.java"},"deprecated":false,"digest":{"function_hash":"253662207814804342995731307521656410278","length":789},"id":"CVE-2026-82462-90f117d6","signature_type":"Function"},{"source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-core/src/test/java/org/pac4j/core/authorization/authorizer/CheckProfileTypeAuthorizerTests.java"},"deprecated":false,"digest":{"line_hashes":["40281916700052440885580126907807852942","119238506930760920303625727206026639401","31137903961039410148896240334737595214","308826562651019835726327188230444347362","290670159507289381662125508428435800692","299891221239856802702303718329969395458"],"threshold":0.9},"id":"CVE-2026-82462-a040d13b","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-82462-c05f6805","signature_type":"Line","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-saml/src/main/java/org/pac4j/saml/logout/impl/SAML2LogoutValidator.java"},"deprecated":false,"digest":{"line_hashes":["163550059666488893000538453667940556826","74836202808132892638920943831195976735","32557203701126590420683582310441958311","184294962807744105889003556627268930994"],"threshold":0.9}},{"id":"CVE-2026-82462-c4f205e4","signature_type":"Function","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/test/java/org/pac4j/oidc/profile/creator/OidcProfileCreatorTests.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"307783685376099534620965071806702172496","length":1287}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"function":"generate","file":"pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.java"},"deprecated":false,"digest":{"function_hash":"239709721847536462794826129103049170658","length":843},"id":"CVE-2026-82462-c5494a37"},{"digest":{"function_hash":"328287649516005072098844986888263366933","length":2659},"id":"CVE-2026-82462-d5acbf1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-core/src/main/java/org/pac4j/core/engine/DefaultLogoutLogic.java","function":"perform"},"deprecated":false},{"source":"https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e","target":{"file":"pac4j-oidc/src/test/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGeneratorTests.java"},"deprecated":false,"digest":{"line_hashes":["13620896822420011942642207336185177588","19145922205586418673390600226910886085","309488864442394482289523784863282148195","239843423116169937264402859629640304865","35454419544658925480006053255009837211","206829140979034528783606864157073285161","169890920464669832169477358113370550140","28875249103568878274267274905969592780","190208358522041153457203199590612897557","299541229030863326004775791106265005937","224634273950208524322388565847024555153","28011045098977482624230975851577897277","23306779456295253651056054339389532855","323660634195481617209927266172130225817","133978879348796187645122620190150855812","74905084878863049812276995375418825152","83064426288687278007412023408162284843","275573952352625224770414695070412109236","232152174355465860094477172815746424259","116754953779622245749659025316615455391","292537925980043800250852843177053228355","176963824435566751585558375534556255465","11015614558905483911443256475734961721","333802878415888243709491150140715407284","167930684909164836293554930952486055852","154756951979104678285778790886762522746","105023880710108927248356691141123709074","49986140815978647747815923078238920691","294864442951525799079618696783685632909","248309733296243524742844336135506069310","280983549348160429016122462411093469749","294604765403215690533303464735672875624","113627820619856122422778524311156074068"],"threshold":0.9},"id":"CVE-2026-82462-dc212184","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-28T11:18:14Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}