CVE-2026-40459

PAC4J versions prior to 4.5.10, 5.7.10, and 6.4.1 contain an LDAP Injection vulnerability affecting multiple methods within the library. A low-privileged remote attacker can inject malicious LDAP syntax into ID-based search parameters to execute unauthorized LDAP queries and perform arbitrary directory operations against vulnerable systems. The vulnerability is rated HIGH severity with a CVSS 3.1 score of 8.8, indicating significant risk. The attack requires network access with low privileges but minimal complexity, and carries high impact across confidentiality, integrity, and availability of affected systems. No user interaction is required for exploitation. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. With an EPSS score of 0.0014, the probability of exploitation in the wild is low relative to other disclosed vulnerabilities. Organizations should prioritize patching to the fixed versions listed above, particularly for systems handling sensitive directory information.