org.pac4j:pac4j-core 6.4.1

Direct Vulnerabilities

Known vulnerabilities in the org.pac4j:pac4j-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Incorrect Authorization org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services. Affected versions of this package are vulnerable to Incorrect Authorization in the `CheckProfileTypeAuthorizer` function. An attacker can gain unauthorized access to resources by authenticating through a client with weaker profile requirements and bypassing intended profile type checks. How to fix Incorrect Authorization? Upgrade `org.pac4j:pac4j-core` to version 6.5.6 or higher.	[,6.5.6)
M Open Redirect org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services. Affected versions of this package are vulnerable to Open Redirect in the `perform` function of `DefaultLogoutLogic` when processing logout requests containing backslash-prefixed redirect targets that match the configured logout URL pattern. An attacker can redirect users to malicious sites by crafting logout links with backslash-prefixed external hosts, which browsers interpret as network-path references. How to fix Open Redirect? Upgrade `org.pac4j:pac4j-core` to version 6.5.6 or higher.	[,6.5.6)

Vulnerability

Vulnerable Version

Incorrect Authorization

org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services.

Affected versions of this package are vulnerable to Incorrect Authorization in the CheckProfileTypeAuthorizer function. An attacker can gain unauthorized access to resources by authenticating through a client with weaker profile requirements and bypassing intended profile type checks.

How to fix Incorrect Authorization?

Upgrade org.pac4j:pac4j-core to version 6.5.6 or higher.

[,6.5.6)

Open Redirect

Affected versions of this package are vulnerable to Open Redirect in the perform function of DefaultLogoutLogic when processing logout requests containing backslash-prefixed redirect targets that match the configured logout URL pattern. An attacker can redirect users to malicious sites by crafting logout links with backslash-prefixed external hosts, which browsers interpret as network-path references.

How to fix Open Redirect?

Upgrade org.pac4j:pac4j-core to version 6.5.6 or higher.

[,6.5.6)

org.pac4j:pac4j-core@6.4.1

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically