{"cve":"CVE-2021-44878","nvd":{"published":"2022-01-06T13:15:08.180","modified":"2026-06-17T04:12:55.477","status":"Modified","description":"If an OpenID Connect provider supports the \"none\" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an explicit configuration on its side or for the \"idtoken\" response type which is not secure and violates the OpenID Core Specification. The \"none\" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using \"none\" as the value of \"alg\" key in the header with an empty signature value.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-347"],"references":["https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae","https://openid.net/specs/openid-connect-core-1_0.html#IDToken","https://www.pac4j.org/blog/cve_2021_44878_is_this_serious.html","https://github.com/pac4j/pac4j/commit/22b82ffd702a132d9f09da60362fc6264fc281ae","https://openid.net/specs/openid-connect-core-1_0.html#IDToken"],"products":["pac4j:pac4j"],"source":"nvd","synced_at":"2026-10-19T21:26:33.761856376+00:00"},"epss":{"cve":"CVE-2021-44878","score":0.00925,"percentile":0.60447,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xhw6-hjc9-679m","url":"https://osv.dev/vulnerability/GHSA-xhw6-hjc9-679m","summary":"Pac4j token validation bypass if OpenID Connect provider supports none algorithm","modified":"2024-02-16T08:23:56.582364Z","packages":[{"ecosystem":"Maven","name":"org.pac4j:pac4j-oidc","purl":"pkg:maven/org.pac4j/pac4j-oidc","ranges":["<4.5.5"],"fixed":["4.5.5"]},{"ecosystem":"Maven","name":"org.pac4j:pac4j-oidc","purl":"pkg:maven/org.pac4j/pac4j-oidc","ranges":[">=5.0 <5.3.1"],"fixed":["5.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}