CVE-2026-40459: PAC4J

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

Affected products

• PAC4J PAC4J: from 4.0.0, before 4.5.10 (fixed in 4.5.10); from 5.0.0, before 5.7.10 (fixed in 5.7.10); from 6.0.0, before 6.4.1 (fixed in 6.4.1)

Published 2026-04-17. Last modified 2026-06-17.