Description

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-29T17:17:58.490Z",
  "pubdate": "2026-08-29T17:17:58.490Z",
  "executiveSummary": "The pac4j-core library, specifically versions prior to 6.5.6, is affected by a critical authentication bypass vulnerability located in the CheckProfileTypeAuthorizer component.\nThe vulnerability manifests as a logical error in the profile type validation mechanism, where the intended logic is effectively reversed.\nThis flaw allows unauthorized users to bypass strict security constraints by authenticating with a lower-privilege or 'weaker' client profile.\nBy successfully satisfying generic profile criteria, an attacker can gain unauthorized access to resources that were explicitly intended to be restricted to users with stronger or more specific profile types.\nThe vulnerability represents a significant security risk, as it permits lateral movement or privilege escalation within the application context.\nExploitation does not require advanced access but relies on the manipulation of the application's authorization workflow during the authentication session.\nAffected organizations should immediately prioritize updating to version 6.5.6 or later to remediate the logic error.",
  "technicalDetails": "The vulnerability resides within the CheckProfileTypeAuthorizer component of pac4j-core. This class is responsible for enforcing access control based on the type of the authenticated user's profile.\nThe root cause is a fundamental inversion of the boolean validation logic used to compare the current session's profile type against the required profile type. Instead of strictly enforcing a match or an inheritance-based validation (where the session profile must be an instance of or compatible with the required type), the implementation incorrectly validates the presence of a generic profile.\nIn a standard deployment, an application might utilize an Authorizer to ensure that only users with a specific, highly privileged profile (e.g., 'AdminProfile') can access an administrative endpoint. Because of the logic reversal, the CheckProfileTypeAuthorizer incorrectly treats the requirements as a satisfy-any condition rather than a strict enforcement of the expected type hierarchy.\nThe attack flow proceeds as follows: First, an attacker authenticates against the application using a legitimate, low-privilege client profile, such as a basic 'User' profile. Second, the attacker attempts to access a protected resource that is configured with a CheckProfileTypeAuthorizer expecting a more restrictive profile. Third, the vulnerability causes the authorizer to improperly validate the session's existing, weaker profile against the requirement. Because the implementation reverses the check, the logic identifies the weaker profile as satisfying the condition, thereby granting access.\nThis authentication bypass effectively nullifies the purpose of the security interceptor. The component fails to perform a rigorous type check, allowing any authenticated session—regardless of the specific client profile—to pass the authorization gate if the generic session validation succeeds.\nThe impact of this vulnerability includes unauthorized access to sensitive application functionality, potential data exposure, and the circumvention of Role-Based Access Control (RBAC) policies defined within the application. Since the issue exists within the core library, any application relying on CheckProfileTypeAuthorizer for profile-based authorization is potentially exposed.\nThe vulnerability is present in all versions of pac4j-core prior to 6.5.6. Remediation requires an update to the library, as the fix involves correcting the underlying logical comparison operations within the source code of the authorizer."
}