PT-2026-33452 · Pac4J · Pac4J

Published 2026-04-17 · Updated 2026-04-19 · CVE-2026-40459

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pac4j versions prior to 4.5.10 pac4j versions prior to 5.7.10 pac4j versions prior to 6.4.1

Description LDAP Injection is possible in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, which may lead to unauthorized LDAP queries and arbitrary directory operations.

Recommendations Update to version 4.5.10. Update to version 5.7.10. Update to version 6.4.1.

Fix

Weakness Enumeration

CWE-90

Related Identifiers

CVE-2026-40459

Affected Products

Pac4J

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40459 · Security Note
• https://pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html · Vendor Advisory
• https://twitter.com/vuldb/status/2045254274343743881 · Twitter Post
• https://twitter.com/CVEnew/status/2045889739765567548 · Twitter Post
• https://cert.pl/en/posts/2026/04/CVE-2026-40458 · Note