CVE-2026-82461

pac4j-oidc before 6.5.6 (CWE-347, improper verification of cryptographic signature) fails to check the signature, issuer, audience, or expiry of access tokens when it extracts Keycloak realm and client roles, so authorization decisions are built on tokens that were never validated. An attacker who already holds any valid login can pair a legitimate ID token with a self-forged access token carrying administrative Keycloak realm/client roles, and applications relying on pac4j role validation will accept the forged roles. This yields an authorization bypass and privilege escalation to administrative access (CVSS 4.0: 8.6 High; network vector, low complexity, low privileges required, no user interaction). Anyone running Java applications that authenticate through pac4j-oidc versions before 6.5.6 and derive authorization roles from Keycloak tokens is affected. No exploitation is currently known: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS assigns roughly a 0.2% probability of exploitation within 30 days.

What to do: Upgrade pac4j-oidc to 6.5.6 or later. As an interim mitigation, have applications independently validate access token signature, issuer, audience, and expiry before trusting any roles extracted from them, or stop deriving authorization solely from pac4j's Keycloak role extraction. Review privileged accounts and authorization logs for signs of access via forged role claims.