pac4j-oidc before version 6.5.6 fails to verify the signature, issuer, audience, or expiration of Keycloak access tokens when extracting realm and client roles. The omission allows an attacker to forge an access token that includes administrative roles while pairing it with a valid ID token. When such a forged token is used, applications that rely on pac4j for role validation bypass normal authorization checks, effectively granting the attacker elevated privileges. The vulnerability is a classic instance of improper token validation, categorised as CWE‑347, and can lead to unauthorized actions such as modifying application configuration, accessing protected resources, or escalating privileges across the system.

The issue impacts the Pac4j library, specifically pac4j-oidc components in versions prior to 6.5.6. Any application that integrates this library for Keycloak SSO and relies on pac4j role extraction is potentially affected.

With a CVSS score of 8.6, the vulnerability is considered high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits at the time of analysis. Attackers must be able to submit a forged token, which typically requires network access to the authentication endpoint or control over the token creation process. Since the vulnerability arises from the lack of signature verification, an attacker can freely generate a token that satisfies all expected claims apart from the signature. Once the forged token is presented to the application, privileged actions can be performed without further authentication steps.