CVE-2026-82464

MediumCVSS 6.1

Published: 29/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Summary

pac4j-core before version 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.

Risk Assessment

The risk involves redirecting users to malicious sites after logout, which could lead to phishing or data theft.

Recommendation

It is recommended to upgrade pac4j-core to version 6.5.6 or later, which includes a fix for redirect target validation.

Other vulnerabilities in pac4j-core

CVE-2026-82463High
pac4j-core before version 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks.

Original NVD description (English source)

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.