CVE-2026-82465: pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can submit an unsigned SAML LogoutRequest. Exploitation depends on the attacker being able to guess a victim's NameID, such as an email address used as the NameID.
When does an unsigned LogoutRequest destroy a session?
The affected validation path can destroy a session based solely on NameID when the IdP sends no SessionIndex. In that condition, signature validation is not required before the session is terminated.
What is the impact of successful exploitation?
A successful request terminates the victim's SAML session. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.