Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-40459

LDAP Injection in PAC4J

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PAC4J PAC4J

Default version status: unaffected

  • 4.0 to < 4.5.10affected
  • 5.0 to < 5.7.10affected
  • 6.0 to < 6.4.1affected

References