Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-40458, CVE-2026-40459) found in PAC4J software.
Analysis Summary
# Vulnerability: Multiple Flaws in PAC4J (CSRF and LDAP Injection)
## CVE Details
- **CVE ID:** CVE-2026-40458, CVE-2026-40459
- **CVSS Score:** Not explicitly provided in the article (Estimated High based on technical impact)
- **CWE:**
- CWE-352: Cross-Site Request Forgery (CSRF)
- CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
## Affected Systems
- **Products:** PAC4J Security Framework
- **Versions:**
- **CVE-2026-40458:** 5.0 to 5.7.9 and 6.0 to 6.4.0
- **CVE-2026-40459:** 4.0 to 4.5.9, 5.0 to 5.7.9, and 6.0 to 6.4.0
- **Configurations:** Systems utilizing PAC4J for CSRF protection or LDAP-based authentication/lookups.
## Vulnerability Description
- **CVE-2026-40458 (CSRF):** The software relies on the deterministic `String.hashCode()` function for token validation. This function is susceptible to hash collisions, which reduces the effective security space of the CSRF token to only 32 bits. An attacker can pre-compute these collisions to bypass protection without needing to know the victim's actual token.
- **CVE-2026-40459 (LDAP Injection):** Multiple methods within PAC4J fail to properly neutralize ID-based search parameters. This allows a remote attacker to inject LDAP syntax into queries, leading to unauthorized directory operations.
## Exploitation
- **Status:** PoC availability implied (collisions are "computed directly"); no mention of active exploitation in the wild.
- **Complexity:** Medium (requires knowledge of hash collision generation or LDAP syntax).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Unauthorized LDAP directory access; profile data exposure).
- **Integrity:** High (Bypass CSRF to change passwords, link accounts, or perform state-changing operations).
- **Availability:** Low to Medium (Potential for unauthorized directory modifications).
## Remediation
### Patches
Users should upgrade to the following versions or higher:
- **PAC4J 4.5.10** (Fixes CVE-2026-40459)
- **PAC4J 5.7.10** (Fixes both CVEs)
- **PAC4J 6.4.1** (Fixes both CVEs)
### Workarounds
No specific workarounds were provided in the advisory; immediate patching of the framework is recommended.
## Detection
- **Indicators of Compromise:** Unusual LDAP query patterns in server logs containing special characters (e.g., `*`, `(`, `)`, `&`, `|`).
- **Detection methods:** Audit web traffic for multiple failed CSRF attempts or requests containing tokens with known 32-bit hash collisions.
## References
- **Vendor Advisory:** hxxps[://]cert[.]pl/en/posts/2026/04/vulnerabilities-in-pac4j/
- **CVE Records:**
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-40458
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-40459
- **CVD Program:** hxxps[://]cert[.]pl/en/cvd/