The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.pac4j:pac4j-saml(Maven) | 0 | 3.8.2 | N/A |
CVSS Metrics
