Description

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-29T17:17:58.350Z",
  "pubdate": "2026-08-29T17:17:58.350Z",
  "executiveSummary": "The vulnerability identified in pac4j-oidc (versions prior to 6.5.6) concerns improper validation of OpenID Connect (OIDC) callback responses. The flaw manifests when the system accepts an OIDC callback containing solely an access token, bypassing necessary verification of the authorization code, ID token, and associated claims.\nThis authentication bypass vulnerability allows an attacker to manipulate the OIDC handshake process. By substituting an access token originally minted for a different, potentially malicious client, an attacker can coerce the vulnerable application into establishing an authenticated session for an unauthorized user. The impact is significant, as it leads to complete authentication bypass, potential account takeover, and unauthorized resource access.\nThe vulnerability exists in the callback processing logic of the pac4j-oidc integration. An attacker does not require prior authentication or elevated privileges within the target application; they only require the ability to interact with the OIDC callback endpoint. The lack of validation for critical OIDC security parameters—such as issuer, audience (aud), nonce, and subject (sub)—leaves the system susceptible to identity spoofing and impersonation attacks, posing a severe risk to the confidentiality and integrity of user sessions.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient enforcement of OIDC protocol requirements during the token retrieval and validation phase of the pac4j-oidc callback handler. Specifically, the library fails to mandate the presence and cryptographic verification of an ID token when processing an OIDC callback. In a standard OIDC flow, the ID token serves as the primary security assertion, containing identity claims (sub, aud, iss, exp, iat) and a nonce that binds the session to the initial authorization request.\nBy omitting these checks, the component erroneously trusts an access token provided in the callback. The attack flow is as follows: 1) The attacker initiates an OIDC authentication flow with a malicious OIDC Provider or legitimate client application under their control; 2) The attacker obtains a valid access token from that provider; 3) The attacker intercepts the callback process of the target application (the victim); 4) The attacker replaces the expected OIDC callback data with the maliciously obtained access token; 5) The vulnerable pac4j-oidc implementation validates the access token format without verifying the binding to the original authorization request context.\nBecause the implementation does not verify the audience claim against its own Client ID, or the issuer claim against its configured Identity Provider, the application accepts the foreign access token as proof of identity for the local session. Furthermore, the absence of nonce validation allows for replay-style attacks or session injection, as the application fails to ensure the callback corresponds to a request it actually originated. Once the library accepts the token, it creates a security context for the user associated with that token, effectively logging the attacker in as a victim or a phantom user.\nThis vulnerability is present in all pac4j-oidc versions before 6.5.6. It is a logic flaw inherent in the OIDC callback processing function, requiring no specific privilege to reach the vulnerable endpoint. Exploitation is limited only by the attacker's ability to trigger the OIDC callback URL. The post-exploitation impact allows for full session impersonation, granting the attacker the identity and permissions of the user represented by the substituted token within the context of the target application."
}