pac4j records
5 published records for vendor pac4j.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)1
- CWE-347 Improper Verification of Cryptographic Signature1
- CWE-352 Cross-Site Request Forgery (CSRF)1
- CWE-502 Deserialization of Untrusted Data1
- CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
5 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
37Monitor | CVE-2023-25581Proof of concept | Deserialization of untrusted data in InternalAttributeHandler in pac4jpac4j · pac4j · CWE-502 | Critical9.2 | — | 1.9% | Oct 10, 2024 |
34Monitor | CVE-2026-40459No exploit | LDAP Injection in PAC4Jpac4j · pac4j · CWE-90 | High8.7 | — | 0.6% | Apr 17, 2026 |
30Monitor | CVE-2021-44878No exploit | If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it wipac4j · pac4j · CWE-347 | High7.5 | — | 0.8% | Jan 6, 2022 |
28Monitor | CVE-2026-40458No exploit | Cross-Site Request Forgery in PAC4Jpac4j · pac4j · CWE-352 | High7.0 | — | 0.1% | Apr 17, 2026 |
19Monitor | CVE-2019-10755No exploit | The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes tpac4j · pac4j · CWE-338 | Medium4.9 | — | 1.1% | Sep 23, 2019 |
- CVE-2023-2558137Monitor
Deserialization of untrusted data in InternalAttributeHandler in pac4j
CriticalCVSS 9.2Proof of conceptEPSS 1%pac4j · pac4jOct 10, 2024
- CVE-2026-4045934Monitor
LDAP Injection in PAC4J
HighCVSS 8.7No exploitEPSS 0%pac4j · pac4jApr 17, 2026
- CVE-2021-4487830Monitor
If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it wi
HighCVSS 7.5No exploitEPSS 0%pac4j · pac4jJan 6, 2022
- CVE-2026-4045828Monitor
Cross-Site Request Forgery in PAC4J
HighCVSS 7.0No exploitEPSS 0%pac4j · pac4jApr 17, 2026
- CVE-2019-1075519Monitor
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes t
MediumCVSS 4.9No exploitEPSS 1%pac4j · pac4jSep 23, 2019