pac4j-oidc before version 6.5.6 is vulnerable to an authentication bypass that occurs when the library accepts OIDC callbacks containing only an access token. The access token supplied by an attacker can be one that was issued to a different client, and the library does not perform issuer, audience, nonce, or subject validation. As a result, an attacker can substitute a token, cause the application to establish a session, and gain unauthorized access as the substituted subject.

Any Java application that incorporates the pac4j library and uses pac4j-oidc for OpenID Connect authentication, specifically when running a version of pac4j-oidc earlier than 6.5.6, is at risk. This includes applications that rely on pac4j to extract credentials and create user sessions from OIDC callbacks.

The CVSS score of 6.9 indicates a moderate severity, and the attack can be executed remotely by sending a crafted OIDC callback request to the application’s callback endpoint that carries only an access token without accompanying authorization code or ID token. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the ability to impersonate users and establish unauthorized sessions makes it a serious security concern.