---
id: CVE-2026-82461
title: >-
  pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers,
  audiences, or expiry when extracting Keycloak realm and client roles
summary: >-
  pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers,
  audiences, or expiry when extracting Keycloak realm and client roles.
  Attackers can forge access tokens with administrative roles paired with valid
  ID tokens to by…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-347
published: '2026-08-29'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:54:25.810'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82461'
references:
  - url: 'https://github.com/pac4j/pac4j'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/authorization/generator/KeycloakRolesAuthorizationGenerator.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e
    label: disclosure@vulncheck.com
  - url: 'https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-privilege-escalation-via-unverified-keycloak-access-token
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00316
epssPercentile: 0.21905
ingestedAt: '2026-08-30T07:49:09.028Z'
---

## Overview

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.