CVE-2026-40458 Details
Description
PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent. This issue was fixed in PAC4J versions 5.7.10 and 6.4.1
A Cross-Site Request Forgery (CSRF) vulnerability exists in PAC4J versions 5.0 prior to 5.7.10 and 6.0 prior to 6.4.1. This vulnerability allows attackers to exploit the application's CSRF protection by crafting a malicious website that submits a forged request using a token that collides with the victim's legitimate CSRF token. The attacker does not need to know the victim's token or its hash beforehand. This exploitation can bypass CSRF safeguards, enabling unauthorized profile updates, password changes, account linking, and other state-altering actions.
Users should upgrade to PAC4J version 5.7.10 or 6.4.1. Instructions for upgrading can be found in the PAC4J security advisory on the PAC4J website.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/en/posts/2026/04/CVE-2026-40458/ | [email protected] | Third Party Advisory |
| https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pac4j pac4j | >= 5.0.0, < 5.7.10 > 6.0.0, < 6.4.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |