PAC4J Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in PAC4J versions 5.0 prior to 5.7.10 and 6.0 prior to 6.4.1. This vulnerability allows attackers to exploit the application's CSRF protection by crafting a malicious website that submits a forged request using a token that collides with the victim's legitimate CSRF token. The attacker does not need to know the victim's token or its hash beforehand. This exploitation can bypass CSRF safeguards, enabling unauthorized profile updates, password changes, account linking, and other state-altering actions.

Impact

Exploitation of this vulnerability allows for unauthorized actions to be performed on behalf of the user, such as changing passwords, updating profiles, linking accounts, and other state-changing operations, all without the user's consent.

Remediation

Users should upgrade to PAC4J version 5.7.10 or 6.4.1. Instructions for upgrading can be found in the PAC4J security advisory on the PAC4J website.