CVE-2021-44878

HIGH
Published Jan 6, 20224y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jan 6, 2022 4y ago
Last Modified Jun 17, 2026 2w ago

Description

If an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-347

Affected Products 2

VendorProductVersionRange
pac4jpac4j* <4.5.5
pac4jpac4j*≥5.0.0  –  <5.3.1

References 3

  • github.com https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae
    PatchThird Party Advisory
  • openid.net https://openid.net/specs/openid-connect-core-1_0.html#IDToken
    ProductThird Party Advisory
  • pac4j.org https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html
    MitigationVendor Advisory

Remediation

  • github.com https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae
    PatchThird Party Advisory