CVE-2026-40458: CSRF in PAC4J Core

An attacker exploiting this CSRF vulnerability in PAC4J Core could potentially gain unauthorized access to user accounts and perform actions such as modifying user profiles, changing passwords, or executing other actions permitted by the application. The attack doesn't require prior knowledge of the victim's CSRF token or its hash, significantly simplifying the attack process. The reliance on String.hashCode() for CSRF protection creates a predictable collision point, making it easier for attackers to craft malicious requests. This bypasses standard CSRF defenses and could lead to significant data breaches and account compromise.

1. Reserved2026-04-13
2. Published2026-04-17
3. EPSS updated2026-04-25

The primary mitigation for CVE-2026-40458 is to upgrade PAC4J Core to version 6.4.1 or later, which addresses the hash collision vulnerability. If upgrading is not immediately feasible, consider implementing additional CSRF protection measures, such as double-submit cookies or implementing more robust token generation algorithms. Web Application Firewalls (WAFs) configured to detect and block suspicious cross-site requests can provide an additional layer of defense. Review and strengthen input validation and output encoding practices to minimize the impact of successful CSRF attacks. After upgrading, confirm the fix by attempting to trigger a CSRF attack and verifying that the protection mechanisms are functioning correctly.