PAC4J patches CSRF bypass and LDAP injection flaws
PAC4J authentication library patched critical CSRF bypass via hash collision and LDAP injection flaws enabling unauthorized account operations.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of two vulnerabilities in the PAC4J authentication framework. CVE-2026-40458 is a CSRF protection bypass that exploits predictable hash collisions in Java's String.hashCode() function, reducing CSRF token security to 32 bits. Attackers can craft malicious websites that automatically submit forged requests with colliding token hashes, enabling unauthorized profile updates, password changes, and account linking without victim knowledge or consent. The attacker requires no prior knowledge of the victim's actual CSRF token.
CVE-2026-40459 affects LDAP authentication implementations in PAC4J, allowing low-privileged remote attackers to inject malicious LDAP syntax into ID-based search parameters. This can result in unauthorized directory queries and arbitrary LDAP operations. Both vulnerabilities have been patched across multiple PAC4J version branches (4.5.10, 5.7.10, and 6.4.1), indicating widespread deployment of the affected library.
Organizations using PAC4J for authentication should prioritize upgrading to patched versions immediately, as both vulnerabilities enable significant unauthorized access and account manipulation. The CSRF bypass is particularly concerning due to its low attack complexity and the predictable nature of the hash collision technique.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-40458
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs