CVE-2026-40458

CVE-2026-40458 is a CSRF vulnerability in PAC4J. A malicious site can cause a user’s browser to submit forged requests with a token whose hash collides with the victim’s legitimate CSRF token, without needing the token or its hash in advance. The root cause involves collisions in the deterministi...

CVE-2026-40458 Cross-Site Request Forgery in PAC4J

PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...

CVE-2026-40458 Cross-Site Request Forgery in PAC4J

PAC4J is vulnerable to Cross-Site Request Forgery CSRF. A malicious attacker can craft a specially designed website which, when visited by a user, will automatically submit a forged cross-site request with a token whose hash collides with the victim's legitimate CSRF token. Importantly, the...

CVE-2017-18106

The identifierhash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifierhash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain...