CVE-2026-82463

pac4j-core, the core module of the open-source pac4j security library for JVM applications, contains a flaw in CheckProfileTypeAuthorizer (CWE-863, incorrect authorization) that reverses the profile type validation logic. An attacker who holds a valid session from a weaker authentication client can reach resources intended to require a stronger profile type, because generic profile checks are satisfied instead of the stricter per-client-type validation. Successful exploitation grants unauthorized access to protected application endpoints, with high confidentiality and integrity impact reflected in the 8.6 CVSS 4.0 score. Deployments of pac4j-core in versions before 6.5.6 that rely on this authorizer to distinguish profile types across authentication clients are affected. No public proof-of-concept, KEV listing, or confirmed exploitation is known, and the EPSS probability is low (0.3% over 30 days).

What to do: Upgrade pac4j-core to version 6.5.6 or later. Audit your authorization configuration for uses of CheckProfileTypeAuthorizer and verify that endpoints meant for stronger profile types cannot be reached with sessions from weaker authentication clients. Since no public exploit exists, priority should focus on internet-facing applications that gate access by profile type.