# PAC4J authentication library patched critical CSRF bypass via hash collision and LDAP…

Published: 2026-04-17 · Severity: high
Canonical: https://vorant.io/reports/4c7f0425-e4ae-4cca-8704-62572075e558/pac4j-authentication-library-patched-critical-csrf-bypass-via-hash-collision

> PAC4J authentication library patched critical CSRF bypass via hash collision and LDAP injection flaws enabling unauthorized account operations.

CERT Polska coordinated disclosure of two vulnerabilities in the PAC4J authentication framework. CVE-2026-40458 is a CSRF protection bypass that exploits predictable hash collisions in Java's String.hashCode() function, reducing CSRF token security to 32 bits. Attackers can craft malicious websites that automatically submit forged requests with colliding token hashes, enabling unauthorized profile updates, password changes, and account linking without victim knowledge or consent. The attacker requires no prior knowledge of the victim's actual CSRF token.

CVE-2026-40459 affects LDAP authentication implementations in PAC4J, allowing low-privileged remote attackers to inject malicious LDAP syntax into ID-based search parameters. This can result in unauthorized directory queries and arbitrary LDAP operations. Both vulnerabilities have been patched across multiple PAC4J version branches (4.5.10, 5.7.10, and 6.4.1), indicating widespread deployment of the affected library.

Organizations using PAC4J for authentication should prioritize upgrading to patched versions immediately, as both vulnerabilities enable significant unauthorized access and account manipulation. The CSRF bypass is particularly concerning due to its low attack complexity and the predictable nature of the hash collision technique.

## Mentioned in this report

- Vulnerabilities: CVE-2026-40458, CVE-2026-40459

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-40458

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4c7f0425-e4ae-4cca-8704-62572075e558/pac4j-authentication-library-patched-critical-csrf-bypass-via-hash-collision.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup