# PAC4J CSRF bypass via hashCode collision

Published: 2026-04-17 · Severity: high
Canonical: https://vorant.io/reports/dfb5f401-cfe2-5b8a-af45-1d0f7be94e2b/pac4j-csrf-bypass-via-hashcode-collision

> PAC4J authentication library contains a critical CSRF flaw allowing attackers to forge tokens via hash collisions and an LDAP injection vulnerability enabling unauthorized directory queries.

CERT Polska coordinated disclosure of two vulnerabilities in the PAC4J authentication library. CVE-2026-40458 is a critical CSRF bypass where attackers can exploit collisions in Java's String.hashCode() function to craft tokens that match victims' legitimate CSRF tokens without prior knowledge. The deterministic 32-bit hash function reduces the effective security space, enabling attackers to perform unauthorized state-changing operations including profile updates, password changes, and account linking through a malicious website.

CVE-2026-40459 is an LDAP injection vulnerability affecting multiple methods in PAC4J. Low-privileged remote attackers can inject crafted LDAP syntax into ID-based search parameters, potentially executing unauthorized LDAP queries and arbitrary directory operations. Both vulnerabilities have been patched in PAC4J versions 5.7.10 and 6.4.1, with the LDAP injection also fixed in version 4.5.10.

The vulnerabilities were responsibly disclosed by Bartłomiej Dmitruk of striga.ai through CERT Polska's coordinated vulnerability disclosure process. Organizations using PAC4J should prioritize upgrading to patched versions immediately to prevent potential account takeover and unauthorized directory access.

## Mentioned in this report

- Vulnerabilities: CVE-2026-40458, CVE-2026-40459

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-40458

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dfb5f401-cfe2-5b8a-af45-1d0f7be94e2b/pac4j-csrf-bypass-via-hashcode-collision.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup