CVE-2026-82464: pac4j-core before 6.5.6 Open Redirect via Backslash Logout
pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pac4j-coreto a version that resolves this vulnerability.Fixed in 6.5.6 - Configuration
Ensure DefaultLogoutLogic.perform() does not accept backslash-prefixed logout redirect targets that match logoutUrlPattern; apply the vendor fix by upgrading pac4j-core to 6.5.6 (pac4j-core before 6.5.6 is vulnerable).
pac4j-core DefaultLogoutLogic.perform() logoutUrlPattern/backslash-prefixed external hosts handling = Disallow backslash-prefixed external hosts that browsers normalize into network-path references
Event History
Frequently Asked Questions
Which deployments are affected?
pac4j-core versions before 6.5.6 are affected. The vulnerable behavior is in DefaultLogoutLogic.perform() when processing logout redirect targets.
What does an attacker need to exploit this issue?
An attacker needs to induce a victim to use a crafted logout link. The redirect target must match the deployment's logoutUrlPattern and use a backslash-prefixed external host that the victim's browser normalizes into a network-path reference.
How can I determine whether my configuration is exposed?
Check whether the application uses pac4j-core before 6.5.6 and inspect the logoutUrlPattern applied by DefaultLogoutLogic.perform(). A configuration is exposed if a backslash-prefixed redirect target can satisfy that pattern and be processed as a logout destination.
What is the available remediation?
Upgrade pac4j-core to version 6.5.6 or later, which is outside the affected version range.