Skip to content
OpenAdvisories

Package · Maven

org.pac4j:pac4j-oidc

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2021-44878

    Pac4j token validation bypass if OpenID Connect provider supports none algorithm

    If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the Ope…

    org.pac4j:pac4j-oidc Maven