Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.pac4j/pac4j-core@1.5.1
Typemaven
Namespaceorg.pac4j
Namepac4j-core
Version1.5.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version5.7.10
Latest_non_vulnerable_version6.4.1
Affected_by_vulnerabilities
0
url VCID-n3a6-c383-rfbd
vulnerability_id VCID-n3a6-c383-rfbd
summary 
PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent.

This issue was fixed in PAC4J versions 5.7.10 and 6.4.1
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-40458
reference_id
reference_type
scores
0
value 6e-05
scoring_system epss
scoring_elements 0.00405
published_at 2026-06-14T12:55:00Z
1
value 6e-05
scoring_system epss
scoring_elements 0.00397
published_at 2026-06-13T12:55:00Z
2
value 6e-05
scoring_system epss
scoring_elements 0.004
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-40458
1
reference_url https://cert.pl/en/posts/2026/04/CVE-2026-40458
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://cert.pl/en/posts/2026/04/CVE-2026-40458
2
reference_url https://github.com/pac4j/pac4j
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pac4j/pac4j
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-40458
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-40458
4
reference_url https://cert.pl/en/posts/2026/04/CVE-2026-40458/
reference_id CVE-2026-40458
reference_type
scores
0
value 7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-17T13:57:28Z/
url https://cert.pl/en/posts/2026/04/CVE-2026-40458/
5
reference_url https://github.com/advisories/GHSA-xw5c-jc7x-gf75
reference_id GHSA-xw5c-jc7x-gf75
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xw5c-jc7x-gf75
6
reference_url https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html
reference_id security-advisory-pac4j-core-and-ldap.html
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
1
value 7
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
2
value 7.0
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
3
value HIGH
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-17T13:57:28Z/
url https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html
fixed_packages
0
url pkg:maven/org.pac4j/pac4j-core@5.7.10
purl pkg:maven/org.pac4j/pac4j-core@5.7.10
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.pac4j/pac4j-core@5.7.10
1
url pkg:maven/org.pac4j/pac4j-core@6.4.1
purl pkg:maven/org.pac4j/pac4j-core@6.4.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.pac4j/pac4j-core@6.4.1
aliases CVE-2026-40458, GHSA-xw5c-jc7x-gf75
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n3a6-c383-rfbd
1
url VCID-wpkc-ecgh-4ycg
vulnerability_id VCID-wpkc-ecgh-4ycg
summary pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core. It can be exploited by providing an attribute that contains a serialized Java object with a special prefix `{#sb64}` and Base64 encoding. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-25581
reference_id
reference_type
scores
0
value 0.14258
scoring_system epss
scoring_elements 0.94572
published_at 2026-06-12T12:55:00Z
1
value 0.14258
scoring_system epss
scoring_elements 0.94579
published_at 2026-06-14T12:55:00Z
2
value 0.14258
scoring_system epss
scoring_elements 0.94554
published_at 2026-06-11T12:55:00Z
3
value 0.14258
scoring_system epss
scoring_elements 0.94578
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-25581
1
reference_url https://github.com/pac4j/pac4j
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/pac4j/pac4j
2
reference_url https://securitylab.github.com/advisories
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://securitylab.github.com/advisories
3
reference_url https://securitylab.github.com/advisories/GHSL-2022-085_pac4j
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://securitylab.github.com/advisories/GHSL-2022-085_pac4j
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-25581
reference_id CVE-2023-25581
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-25581
5
reference_url https://portswigger.net/web-security/deserialization
reference_id deserialization
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-10T16:07:56Z/
url https://portswigger.net/web-security/deserialization
6
reference_url https://github.com/advisories/GHSA-76mw-6p95-x9x5
reference_id GHSA-76mw-6p95-x9x5
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-76mw-6p95-x9x5
7
reference_url https://securitylab.github.com/advisories/GHSL-2022-085_pac4j/
reference_id GHSL-2022-085_pac4j
reference_type
scores
0
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-10T16:07:56Z/
url https://securitylab.github.com/advisories/GHSL-2022-085_pac4j/
8
reference_url https://github.com/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/InternalAttributeHandler.java#L95
reference_id InternalAttributeHandler.java#L95
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
2
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-10T16:07:56Z/
url https://github.com/pac4j/pac4j/blob/5834aeb22ad3a4369dfa572be60d7b20f5784a8f/pac4j-core/src/main/java/org/pac4j/core/profile/InternalAttributeHandler.java#L95
9
reference_url https://github.com/frohoff/ysoserial
reference_id ysoserial
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
2
value 9.2
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-10-10T16:07:56Z/
url https://github.com/frohoff/ysoserial
fixed_packages
0
url pkg:maven/org.pac4j/pac4j-core@4.0.0
purl pkg:maven/org.pac4j/pac4j-core@4.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n3a6-c383-rfbd
1
vulnerability VCID-x4k7-q7vu-4bgk
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.pac4j/pac4j-core@4.0.0
aliases CVE-2023-25581, GHSA-76mw-6p95-x9x5
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wpkc-ecgh-4ycg
2
url VCID-x4k7-q7vu-4bgk
vulnerability_id VCID-x4k7-q7vu-4bgk
summary Pac4j token validation bypass if OpenID Connect provider supports none algorithm
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-44878
reference_id
reference_type
scores
0
value 0.00139
scoring_system epss
scoring_elements 0.33915
published_at 2026-06-14T12:55:00Z
1
value 0.00139
scoring_system epss
scoring_elements 0.33737
published_at 2026-06-11T12:55:00Z
2
value 0.00139
scoring_system epss
scoring_elements 0.33937
published_at 2026-06-13T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-44878
1
reference_url https://github.com/pac4j/pac4j
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pac4j/pac4j
2
reference_url https://github.com/pac4j/pac4j/commit/09684e0de1c4753d22c53b8135d4ef61cfda76f7
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pac4j/pac4j/commit/09684e0de1c4753d22c53b8135d4ef61cfda76f7
3
reference_url https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae
4
reference_url https://github.com/pac4j/pac4j/commit/9c87bbc536ed5d05f940ae015403120df2935589
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pac4j/pac4j/commit/9c87bbc536ed5d05f940ae015403120df2935589
5
reference_url https://openid.net/specs/openid-connect-core-1_0.html#IDToken
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://openid.net/specs/openid-connect-core-1_0.html#IDToken
6
reference_url https://www.pac4j.org/4.5.x/docs/release-notes.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.pac4j.org/4.5.x/docs/release-notes.html
7
reference_url https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2021-44878
reference_id CVE-2021-44878
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2021-44878
9
reference_url https://github.com/advisories/GHSA-xhw6-hjc9-679m
reference_id GHSA-xhw6-hjc9-679m
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xhw6-hjc9-679m
fixed_packages
0
url pkg:maven/org.pac4j/pac4j-core@5.2.0
purl pkg:maven/org.pac4j/pac4j-core@5.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-n3a6-c383-rfbd
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.pac4j/pac4j-core@5.2.0
aliases CVE-2021-44878, GHSA-xhw6-hjc9-679m
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-x4k7-q7vu-4bgk
Fixing_vulnerabilities
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.pac4j/pac4j-core@1.5.1