← Vulnerability feed

Vulnerability record · CVE-2019-10755 · published 23 September 2019

CVE-2019-10755: Pac4j vulnerability

Pac4j · Pac4j

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

4.9 CVSS 3.1 Medium EPSS 1.1% · top 34.9% CWE-338 · CWE-338
4.9CVSS 3.1 base score, v2 4.0
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407 PatchThird Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407 PatchThird Party Advisory

Track CVE-2019-10755 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-40459Pac4j ldap injection vulnerabilityPAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search param…EPSS 0.68%7.5CVE-2021-44878Pac4j improper verification of cryptographic signature vulnerabilityIf an OpenID Connect provider supports the "none" algorithm (i.e., tokens with no signature), pac4j v5.3.0 (and prior) does not refuse it without an …EPSS 0.90%7.0CVE-2026-40458Pac4j cross-site request forgery vulnerabilityPAC4J is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker can craft a specially designed website which, when visited by a user, …EPSS 0.18%

Source: NIST National Vulnerability Database (record CVE-2019-10755), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.