org.pac4j:pac4j-cas (3.8.0), org.pac4j:pac4j-config (3.8.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.0)

org.pac4j:pac4j-core MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.8.0 - org.pac4j:pac4j-config 3.8.0 - org.pac4j:pac4j-couch 3.8.0 - org.pac4j:pac4j-gae 3.8.0 -...

org.pac4j:pac4j-cas (4.5.3), org.pac4j:pac4j-config (4.5.3) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (4.5.3)

org.pac4j:pac4j-core MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 4.5.3 - org.pac4j:pac4j-config 4.5.3 - org.pac4j:pac4j-couch 4.5.3 - org.pac4j:pac4j-gae 4.5.3 -...

Timing Attack

pac4j-sql is vulnerable to timing attack. The password encoding of an authentication request is performed after a user is found. This causes a delay and provides hint to an attacker if the user exists...