CVE-2026-40459

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40459", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-04-13T10:06:07.141Z", "datePublished": "2026-04-17T13:18:39.181Z", "dateUpdated": "2026-04-17T13:54:22.069Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PAC4J", "vendor": "PAC4J", "versions": [{"lessThan": "4.5.10", "status": "affected", "version": "4.0", "versionType": "semver"}, {"lessThan": "5.7.10", "status": "affected", "version": "5.0", "versionType": "semver"}, {"lessThan": "6.4.1", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Bart\u0142omiej Dmitruk, striga.ai"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.<br><br>This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1<br>"}], "value": "PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.\n\nThis issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1"}], "impacts": [{"capecId": "CAPEC-136", "descriptions": [{"lang": "en", "value": "CAPEC-136: LDAP Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-90", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-17T13:18:39.181Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2026/04/CVE-2026-40458/"}, {"tags": ["vendor-advisory"], "url": "https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html"}], "source": {"discovery": "EXTERNAL"}, "title": "LDAP Injection in PAC4J", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T13:52:22.145596Z", "id": "CVE-2026-40459", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T13:54:22.069Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40459", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-17T13:52:22.145596Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T13:53:06.405Z"}}], "cna": {"title": "LDAP Injection in PAC4J", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Bart\u0142omiej Dmitruk, striga.ai"}], "impacts": [{"capecId": "CAPEC-136", "descriptions": [{"lang": "en", "value": "CAPEC-136: LDAP Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PAC4J", "product": "PAC4J", "versions": [{"status": "affected", "version": "4.0", "lessThan": "4.5.10", "versionType": "semver"}, {"status": "affected", "version": "5.0", "lessThan": "5.7.10", "versionType": "semver"}, {"status": "affected", "version": "6.0", "lessThan": "6.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/en/posts/2026/04/CVE-2026-40458/", "tags": ["third-party-advisory"]}, {"url": "https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.\n\nThis issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1", "supportingMedia": [{"type": "text/html", "value": "PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.<br><br>This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-90", "description": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-04-17T13:18:39.181Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40459", "state": "PUBLISHED", "dateUpdated": "2026-04-17T13:54:22.069Z", "dateReserved": "2026-04-13T10:06:07.141Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-04-17T13:18:39.181Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PAC4J", "vendor": "PAC4J", "versions": [{"lessThan": "4.5.10", "status": "affected", "version": "4.0", "versionType": "semver"}, {"lessThan": "5.7.10", "status": "affected", "version": "5.0", "versionType": "semver"}, {"lessThan": "6.4.1", "status": "affected", "version": "6.0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB457685-E812-4C2A-93D4-225AD4389495", "versionEndExcluding": "4.5.10", "versionStartIncluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A9A7C72-1A3D-4386-8324-D31767E591E7", "versionEndExcluding": "5.7.10", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "2122C25D-17AE-4AED-A1FF-376A754963C0", "versionEndExcluding": "6.4.1", "versionStartIncluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.\n\nThis issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1"}], "id": "CVE-2026-40459", "lastModified": "2026-06-17T10:45:19.677", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40459", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T13:52:22.145596Z", "version": "2.0.3"}}]}, "published": "2026-04-17T14:16:34.123", "references": [{"source": "cvd@cert.pl", "tags": ["Third Party Advisory"], "url": "https://cert.pl/en/posts/2026/04/CVE-2026-40458/"}, {"source": "cvd@cert.pl", "tags": ["Vendor Advisory"], "url": "https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-90"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0,4.5.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0,5.7.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0,6.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PAC4J", "source": "cna", "vendor": "PAC4J"}, "product": "pac4j", "vendor": "pac4j"}], "analysis": {"en": {"generated_at": "2026-04-18T09:18:04.666226+00:00", "value": {"mitigation_remediation": ["Upgrade PAC4J to a patched version: 4.5.10, 5.7.10, or 6.4.1, depending on the environment", "If an upgrade cannot be performed immediately, sanitize all ID\u2011based search parameters to eliminate LDAP special characters before they reach PAC4j", "Continuously monitor LDAP queries for unusual activity and keep audit logs to detect potential injection attempts"], "summary": {"action": "Immediate Patch", "impact": "LDAP Injection allowing arbitrary LDAP queries and directory operations"}, "threat_synthesis": {"affected_systems": "The vulnerability is present in PAC4J, the open\u2011source security framework. All releases prior to 4.5.10, 5.7.10, and 6.4.1 were affected; installations of these older versions remain at risk.", "description_and_impact": "PAC4J allows low\u2011privileged remote attackers to inject crafted LDAP syntax into ID\u2011based search parameters. This deficiency permits unauthorized LDAP queries and arbitrary directory operations, potentially exposing sensitive directory data and enabling further exploitation. The weakness is a classic LDAP Injection that compromises application integrity and confidentiality.", "risk_and_exploitability": "The CVSS score of 8.7 indicates a high severity. The EPSS value is not available, and the vulnerability is not listed in CISA KEV. An attacker who can manipulate LDAP search parameters can exploit this flaw remotely, often without requiring elevated privileges. The attack vector is most effective when PAC4J services are exposed over a network, and the impact spans the entire system that relies on PAC4J for authentication or authorization."}}}}, "created": "2026-04-17T14:45:20.908257+00:00", "updated": "2026-04-18T09:30:25.678690+00:00", "vendors": ["pac4j", "pac4j$PRODUCT$pac4j"]}