pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. (CVE-2026-82462)

The vulnerability in pac4j-oidc before version 6.5.6 involves improper validation of OIDC callbacks. Specifically, the library accepts callbacks carrying only an access token and does not perform necessary validation of the authorization code or ID token. This allows attackers to use access tokens minted for different clients to authenticate, bypassing critical checks such as issuer, audience, nonce, and subject verification, potentially leading to unauthorized access.

An attacker can create authenticated sessions by substituting access tokens issued for other clients without undergoing proper validation. This can lead to unauthorized access to applications relying on pac4j-oidc for authentication, potentially compromising confidentiality and integrity of user sessions. The CVSS score of 6.5 indicates a medium severity impact with limited confidentiality and integrity impact and no availability impact.

A fix is available in pac4j-oidc version 6.5.6. Users should upgrade to version 6.5.6 or later to ensure proper validation of OIDC callbacks. No other mitigation guidance is provided, and patch status is confirmed by the version numbering in the description.