pac4j-core before 6.5.6 Open Redirect via Backslash Logout

Advisories

pac4j-core before 6.5.6 Open Redirect via Backslash Logout

severity: medium
date: 8/29/2026
Affecting: pac4j >= 0, < 6.5.6
CVE: CVE-2026-82464
CWE: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: Patch Commit
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-core/src/main/java/org/pac4j/core/engine/DefaultLogoutLogic.java
https://github.com/pac4j/pac4j
Credit: Joshua Rogers (AISLE Research)
Description: pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo