PAC4J hat eine Cross-Site Request Forgery (CSRF) Vulnerabilität

The impact of this CSRF vulnerability is significant, as it allows an attacker to perform actions on behalf of an authenticated user without their knowledge or consent. Specifically, an attacker could leverage this flaw to modify user profiles, change passwords, or perform other sensitive actions that the user is authorized to do. The attacker doesn't need to know the victim's CSRF token beforehand; they can compute hash collisions directly, making exploitation relatively straightforward. This bypasses the intended security measures designed to prevent unauthorized actions via forged requests.

Applications utilizing PAC4J Core for authentication and authorization, particularly those handling sensitive user data, are at risk. Shared hosting environments where multiple applications share the same PAC4J Core library are also particularly vulnerable, as a compromise in one application could potentially impact others.

• java / server:

# Check for PAC4J Core version
java -jar your_application.jar | grep "PAC4J Core"

• generic web:

# Check for suspicious requests in access logs
grep -i "/your/sensitive/endpoint" access.log

1. 2026-04-17Disclosure

   disclosure

1. Reserviert2026-04-13
2. Veröffentlicht2026-04-17
3. EPSS aktualisiert2026-04-25

The primary mitigation for CVE-2026-40458 is to upgrade PAC4J Core to version 6.4.1 or later, which addresses the hash collision vulnerability. If upgrading is not immediately feasible, consider implementing additional CSRF protection measures, such as synchronizer tokens or double-submit cookies, to bolster defenses. Web Application Firewalls (WAFs) configured to detect and block suspicious cross-site requests can also provide a layer of protection. Review and strengthen existing CSRF prevention mechanisms to ensure they are not reliant solely on the vulnerable String.hashCode() implementation.