CVE-2026-40458: 
Java vulnerability analysis and mitigation

CVE-2026-40458 is a Cross-Site Request Forgery (CSRF) vulnerability in the PAC4J security framework (Maven package org.pac4j:pac4j-core) that allows attackers to bypass CSRF token protection through hash collision attacks. The vulnerability was published on April 17, 2026, and affects PAC4J versions 5.0.0 through 5.7.9 and 6.0.0-RC1 through 6.4.0. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.0 (High) (GitHub Advisory, PAC4J Blog).

The root cause is classified as CWE-352 (Cross-Site Request Forgery) and stems from PAC4J's reliance on Java's deterministic String.hashCode() function for CSRF token validation. Because String.hashCode() produces a 32-bit integer, an attacker can precompute hash collisions offline — without ever knowing the victim's actual CSRF token — and craft a forged token whose hash matches the legitimate one. This reduces the effective security space of the CSRF token from its nominal length to just 32 bits, making brute-force collision computation feasible. The attack requires no special privileges and is network-accessible, requiring only that the victim visit a malicious website while authenticated (GitHub Advisory, CERT.PL).

Successful exploitation allows an attacker to perform unauthorized state-changing operations on behalf of an authenticated victim, including profile updates, password changes, and account linking — all without the victim's knowledge or consent. The integrity impact is rated High, as an attacker can manipulate account state and potentially take over accounts. Confidentiality is not directly impacted, but account takeover via password change or account linking could lead to subsequent unauthorized access to sensitive data (GitHub Advisory, PAC4J Blog).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.019% (0th percentile), indicating a low near-term probability of exploitation. No threat actor attribution has been reported.

1. Reconnaissance: Identify web applications using PAC4J versions prior to 5.7.10 or 6.4.1 for authentication/CSRF protection, using dependency scanners or public package metadata.
2. Compute hash collisions: Offline, enumerate strings whose String.hashCode() value matches a target 32-bit hash value. Since Java's hashCode() is deterministic and produces only 2^32 possible values, collisions can be computed without knowing the victim's token.
3. Craft malicious page: Build a webpage containing an auto-submitting HTML form targeting a state-changing endpoint (e.g., password change, profile update) on the vulnerable application, embedding the collision token as the CSRF parameter.
4. Deliver to victim: Lure the authenticated victim to visit the malicious page via phishing, malicious ad, or injected link.
5. Trigger forged request: The victim's browser automatically submits the form with the colliding CSRF token; the server validates the hash match and accepts the forged request, executing the attacker's desired action (GitHub Advisory, CERT.PL).

• Logs: Unexpected state-changing requests (POST to password change, profile update, or account linking endpoints) originating from unusual Referer or Origin headers not matching the application's domain; requests with CSRF tokens that do not match the session-bound token but pass server-side hash validation.
• Network: HTTP POST requests to sensitive endpoints (e.g., /profile/update, /account/password, /account/link) with Referer headers pointing to external or unknown domains.
• Application Behavior: Unexplained account modifications such as password changes, email address updates, or third-party account linkages not initiated by the account owner; audit log entries for sensitive operations without corresponding user-initiated sessions.

Upgrade PAC4J to version 5.7.10 (for the 5.x branch) or 6.4.1 (for the 6.x branch), which fix the CSRF token validation to use a cryptographically secure comparison rather than relying on String.hashCode() (GitHub Advisory, PAC4J Blog). For systems that cannot be immediately patched, implement defense-in-depth measures such as SameSite=Strict or SameSite=Lax cookie attributes, double-submit cookie patterns, or strict Referer/Origin header validation. Prioritize patching production systems handling sensitive user operations.

CERT Polska (CERT.PL) published a dedicated advisory for CVE-2026-40458 shortly after disclosure, indicating recognition of the vulnerability's significance in the European security community (CERT.PL). The vulnerability was also indexed by GitLab's advisory database and covered by several vulnerability aggregation platforms. No major vendor statements beyond the PAC4J project's own security advisory have been identified.