Advisories · Technology
pac4j.
Every CVE that names pac4j among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest
- pac4j
- CWE-345
- CVSS 5.3 Medium
pac4j-core before 6.5.6 Open Redirect via Backslash Logout
- pac4j
- Open redirect
- CVSS 8.6 High
pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check
- pac4j
- Broken access control
- CVSS 6.9 Medium
pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution
- pac4j
- CWE-345
- CVSS 8.6 High
pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token
- pac4j
- Weak cryptography or TLS
- CVSS 8.7 High
LDAP Injection in PAC4J
- PAC4J
- Other injection