---
id: CVE-2026-82462
title: >-
  pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token
  without authorization code or ID token validation
summary: >-
  pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token
  without authorization code or ID token validation. Attackers can substitute
  access tokens minted for other clients to create authenticated sessions
  without prop…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-345
published: '2026-08-29'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T19:54:25.810'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82462'
references:
  - url: 'https://github.com/pac4j/pac4j'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-oidc/src/main/java/org/pac4j/oidc/credentials/extractor/OidcCredentialsExtractor.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e
    label: disclosure@vulncheck.com
  - url: 'https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/pac4j-oidc-before-6.5.6-authentication-bypass-via-access-token-substitution
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00195
epssPercentile: 0.08161
ingestedAt: '2026-08-30T11:51:45.225Z'
---

## Overview

pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.