CVE-2026-40459
High · 8.8CVSS
8.8
EPSS
0.7%
Published
Apr 17, 2026
CISA due date
—
The record
PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before… CWE-90
- CVE-2026-80055 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-90
- CVE-2026-75020 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
- CVE-2026-19271 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')… CWE-90
- CVE-2026-76373 In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with… CWE-90
- CVE-2026-19930 A security flaw has been discovered in Dolibarr up to 23.0.3. CWE-90
- CVE-2026-74241 A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol (LDAP)… CWE-90
- CVE-2026-16071 A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user… CWE-90