pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect… (CVE-2026-82464)

The vulnerability in pac4j-core prior to version 6.5.6 is an open redirect issue within DefaultLogoutLogic.perform(). It occurs because the method accepts logout redirect targets that begin with a backslash and match the logoutUrlPattern. Attackers can exploit this by crafting logout URLs with backslash-prefixed external hosts, which browsers normalize into network-path references. This normalization causes victims to be redirected to attacker-controlled sites after logout, potentially leading to phishing or other malicious activities. The CVE identifier is CVE-2026-82464, and it is classified under CWE-601 (Open Redirect).

Successful exploitation allows an attacker to redirect users to arbitrary external websites after logout, which can facilitate phishing attacks or other social engineering tactics. The vulnerability does not directly compromise confidentiality or availability but impacts integrity and user trust by enabling redirection to malicious sites.

A fix is available in pac4j-core version 6.5.6. Users should upgrade to version 6.5.6 or later to remediate this vulnerability. No other mitigation or temporary workaround is indicated in the available data.