CVE-2026-40458

CVE-2026-40458 is a Cross-Site Request Forgery (CSRF) vulnerability in PAC4J that allows attackers to bypass CSRF token protection through hash collisions in the String.hashCode() function. An attacker can craft a malicious website that, when visited by a user, automatically submits forged requests with tokens whose hashes collide with legitimate CSRF tokens, effectively reducing token security to 32 bits. The attacker requires no prior knowledge of the victim's actual token to execute the attack. The vulnerability carries a CVSS score of 6.5 (Medium) with a network-based attack vector requiring minimal complexity and user interaction. While confidentiality is not impacted, the integrity impact is high, as attackers can perform unauthorized state-changing operations including profile updates, password changes, and account linking without victim consent. PAC4J versions 5.7.10 and 6.4.1 or later contain the fix. Exploitation of this vulnerability is not currently documented in active exploitation campaigns. The EPSS score of 0.00017 indicates extremely low probability of exploitation in the wild relative to other vulnerabilities. CVE-2026-40458 does not appear on CISA's Known Exploited Vulnerabilities catalog and remains on the inactive Hot List, suggesting limited community attention and no publicly available exploit code at this time.