Open Redirect Vulnerability in pac4j-core by PAC4J
CVE-2026-82464

5.3MEDIUM

Key Information:

Vendor

Pac4j

Status
Pac4j
Vendor
CVE Published:
29 August 2026

What is CVE-2026-82464?

The pac4j-core library prior to version 6.5.6 is vulnerable to an open redirect issue, specifically within the DefaultLogoutLogic.perform() method. This vulnerability arises from the acceptance of backslash-prefixed logout redirect targets, which match the defined logoutUrlPattern. Malicious actors can exploit this by crafting logout links that include these backslash-prefixed URLs, which are normalized by browsers into network-path references. This allows attackers to redirect users to unauthorized sites, potentially leading to phishing attacks or exposure of sensitive information after the user logs out.

Affected Version(s)

pac4j 0 < 6.5.6

References

https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc4383...
patch
https://www.pac4j.org/blog/security-advisory-pac4j-core-o...
vendor-advisory
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pa...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joshua Rogers (AISLE Research)
.