CyberRota Analysis
AI-GeneratedThe vulnerability in pac4j-oidc versions prior to 6.5.6 allows attackers to exploit OIDC callbacks that only include an access token, bypassing necessary authorization code and ID token validation. This could lead to unauthorized authenticated sessions, as attackers can use access tokens from different clients without proper verification of issuer, audience, nonce, or subject. Organizations using affected versions of pac4j-oidc should prioritize patching to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification.