These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE record for CVE-2026-82464 was published on 2026-08-29T17:17:58.640Z and has not been modified since then. The pac4j-core library before version 6.5.6 contains an open redirect vulnerability in the DefaultLogoutLogic.perform() method. This vulnerability allows attackers to craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, potentially red [truncated]
The CVE-2026-82463 record indicates that pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer. This vulnerability allows attackers to authenticate through a weaker client and access resources requiring a stronger profile type. The CVE record was published on 2026-08-29T17:17:58.490Z and has not been modified since then. Organizations should review their usa [truncated]
The CVE-2026-82462 vulnerability affects pac4j-oidc versions before 6.5.6. This authentication bypass vulnerability allows attackers to substitute access tokens minted for other clients, potentially leading to unauthorized access. Organizations should be aware of this vulnerability and take steps to mitigate it, particularly those relying on OIDC for authentication. The CVE record was published on 2026-08 [truncated]
CVE-2026-29000 is an authentication bypass vulnerability in pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The vulnerability is located in JwtAuthenticator when processing encrypted JWTs, allowing remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification [truncated]