PAC4J allows low‑privileged remote attackers to inject crafted LDAP syntax into ID‑based search parameters. This deficiency permits unauthorized LDAP queries and arbitrary directory operations, potentially exposing sensitive directory data and enabling further exploitation. The weakness is a classic LDAP Injection that compromises application integrity and confidentiality.

The vulnerability is present in PAC4J, the open‑source security framework. All releases prior to 4.5.10, 5.7.10, and 6.4.1 were affected; installations of these older versions remain at risk.

The CVSS score of 8.7 indicates a high severity. The EPSS value is not available, and the vulnerability is not listed in CISA KEV. An attacker who can manipulate LDAP search parameters can exploit this flaw remotely, often without requiring elevated privileges. The attack vector is most effective when PAC4J services are exposed over a network, and the impact spans the entire system that relies on PAC4J for authentication or authorization.