PAC4J is vulnerable to a Cross‑Site Request Forgery (CSRF) flaw that allows an attacker to create a malicious web page which automatically submits a forged request to a target application. By exploiting a collision in Java’s deterministic String.hashCode() function, the attacker can generate a token whose hash matches the victim’s legitimate CSRF token without knowing the token itself, effectively reducing the token space to 32 bits. This enables the attacker to trigger profile updates, password changes, account linkage, and other state‑changing operations without the user’s consent.

PAC4J versions earlier than 5.7.10 and 6.4.1 are affected. The vulnerability has been addressed in PAC4J 5.7.10 and 6.4.1, so all users running older releases are at risk.

The CVSS score is 7 indicating a high severity level, and the exploitability is high because the attacker does not need to learn the victim’s token. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. The attack vector is a load‑time CSRF where the attacker delivers a harbored payload to an authenticated user, causing the user’s browser to submit a forged request with a colliding token. The deterministic nature of the hashing function is the key exploitable condition.