What’s Vulnerable › Vulnerabilities

CVE-2026-40459: LDAP Injection in PAC4J

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-17 · updated 2026-06-17
• Weakness: CWE-90

Description

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

Affected products

• pac4j: from 4.0.0 before 4.5.10; from 5.0.0 before 5.7.10; from 6.0.0 before 6.4.1 — fixed in 4.5.10, 5.7.10, 6.4.1

How to fix

Upgrade to a fixed version: pac4j 4.5.10, 5.7.10, 6.4.1. Check the vendor advisory for mitigations.

References

• https://cert.pl/en/posts/2026/04/CVE-2026-40458/
• https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html

Get alerted when CVE-2026-40459 or the next vulnerability affects your stack