PT-2026-33451 · Pac4J · Pac4J

Published 2026-04-17 · Updated 2026-04-19 · CVE-2026-40458

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PAC4J versions prior to 5.7.10 PAC4J versions prior to 6.4.1

Description Cross-Site Request Forgery (CSRF) occurs when a malicious attacker crafts a website that automatically submits a forged request using a token whose hash collides with the victim's legitimate CSRF token. This is possible because collisions in the deterministic String.hashCode() function can be computed directly, reducing the security space of the token to 32 bits. This allows an attacker to bypass protections and perform state-changing operations, such as profile updates, password changes, and account linking, without the victim's consent, without needing to know the actual token or its hash beforehand.

Recommendations Update to version 5.7.10. Update to version 6.4.1.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-40458

GHSA-XW5C-JC7X-GF75

Affected Products

Pac4J

References · 7

• https://pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xw5c-jc7x-gf75 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40458 · Security Note
• https://github.com/pac4j/pac4j · Note
• https://twitter.com/CVEnew/status/2045889740814057481 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045214505475424575 · Twitter Post
• https://cert.pl/en/posts/2026/04/CVE-2026-40458 · Note