CVE-2026-40459 LDAP Injection in PAC4J

High 8.7 Published 17 Apr 2026 Updated 17 Apr 2026

A low-privileged attacker can inject LDAP syntax into PAC4J search parameters to perform unauthorized directory queries and operations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-40459?

CVE-2026-40459 is a high-severity vulnerability in PAC4J, published on 17 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations.

This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

Weakness: CWE-90

Which versions are affected by CVE-2026-40459?

It affects 1 product.

Products include Pac4j Pac4j.

How do I fix CVE-2026-40459?

Upgrade to a fixed version.

Is CVE-2026-40459 being exploited?

There is no known exploitation of CVE-2026-40459 in the wild and no public exploit code.

Sources

Also known as CLEANSTART-2026-YN41310, GHSA-3jrj-7493-fgq2.