pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. (CVE-2026-82461)

The vulnerability identified as CVE-2026-82461 affects pac4j-oidc versions prior to 6.5.6. The issue arises because the software fails to verify critical aspects of access tokens—specifically signatures, issuers, audiences, and expiry—during the extraction of Keycloak realm and client roles. This verification failure enables attackers to craft forged access tokens that include administrative roles, which when paired with valid ID tokens, can bypass authorization mechanisms in applications using pac4j for role validation.

Successful exploitation of this vulnerability can lead to unauthorized privilege escalation, allowing attackers to gain administrative access within affected applications. This compromises confidentiality and integrity by bypassing authorization controls. The vulnerability does not impact availability.

A fix is available in pac4j-oidc version 6.5.6 and later. Users should upgrade to version 6.5.6 or newer to ensure proper verification of access token signatures, issuers, audiences, and expiry. Patch status is not explicitly confirmed in the provided data, but the version boundary indicates remediation in 6.5.6. Check the vendor advisory for the latest remediation guidance.