Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the attacker does not need to know the victim’s CSRF token or its hash prior to the attack. Collisions in the deterministic String.hashCode() function can be computed directly, reducing the effective token's security space to 32 bits. This bypasses CSRF protection, allowing profile updates, password changes, account linking, and any other state-changing operations to be performed without the victim's consent. This issue was fixed in PAC4J versions 5.7.10 and 6.4.1
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40458 PAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, will automaticall… https://www.cve.org/CVERecord?id=CVE-2026-40458
Post summary
The passage announces CVE‑2026‑40458 as a CSRF vulnerability in PAC4J, noting that an attacker can craft a malicious website; no PoC, exploit, patch, or active exploitation is mentioned.
CVE-2026-40458 Cross-Site Request Forgery via CSRF Token Hash Collision in PAC4J https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40458
Post summary
The post announces a newly disclosed CSRF vulnerability in PAC4J, describing the technical mechanism but providing no PoC, exploit code, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pac4j | pac4j | - | - | - |