A high-severity authentication bypass vulnerability in pac4j-oidc allows attackers to forge tokens and gain unauthorized administrative access.

The vulnerability resides in the KeycloakRolesAuthorizationGenerator component, which fails to perform cryptographic signature verification or validate token expiry and issuer claims on access tokens. This flaw permits an authenticated user to craft malicious access tokens that the system accepts as valid, effectively bypassing authorization checks.

This vulnerability poses a significant risk to the integrity of identity and access management systems. By forging access tokens, an attacker can elevate their privileges to administrative levels, potentially leading to unauthorized data access, system configuration changes, or complete compromise of protected applications. Given the CVSS score of 8.1, this is a high-priority issue requiring immediate attention to prevent unauthorized lateral movement within the network.

Immediate Action: Update the pac4j-oidc library to version 6.5.6 or later to ensure proper cryptographic validation of access tokens.

Proactive Monitoring: Review authentication and authorization logs for unusual role assignments or anomalies in token processing patterns that may indicate attempts to exploit token validation logic.

Compensating Controls: Implement strict network-level access controls and ensure that Keycloak instances are properly configured to reject unauthorized or malformed tokens at the identity provider level.

Public Exploit Available: No

The security of your authentication flow depends on the integrity of token validation. Because this vulnerability allows an attacker to bypass authorization via token forgery, it should be addressed with high urgency. Organizations using pac4j-oidc must prioritize upgrading to version 6.5.6 immediately to eliminate the risk of privilege escalation.