CVE-2026-40458 | PAC4J up to 5.7.9/6.4.0 String.hashCode cross-site request forgery

A vulnerability marked as problematic has been reported in PAC4J up to 5.7.9/6.4.0. This vulnerability affects the function String.hashCode. This manipulation causes cross-site request forgery.

This vulnerability is registered as CVE-2026-40458. Remote exploitation of the attack is possible. No exploit is available.

It is suggested to upgrade the affected component.