Open Redirect in pac4j-core

Executive Summary

CVE-2026-82464 is an open redirect vulnerability in pac4j-core versions before 6.5.6. It exists in the DefaultLogoutLogic.perform() method where backslash-prefixed logout redirect targets matching logoutUrlPattern are accepted. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.

Useful 0 Not Useful 0

Detection Guidance

Check pac4j-core version with: mvn dependency:tree | grep pac4j-core. If version is below 6.5.6, the system is vulnerable. Inspect DefaultLogoutLogic.perform() in logs for backslash-prefixed redirect URLs. Monitor network traffic for unexpected redirects post-logout.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to redirect users to malicious websites after they log out of a vulnerable application. Users may unknowingly visit phishing sites or download malware. It can also be used for session hijacking or credential theft if combined with other attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure or phishing attacks, violating GDPR's requirement for secure data processing and user protection. For HIPAA, it may compromise protected health information if session data is intercepted post-logout. Compliance requires immediate patching to prevent regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade pac4j-core, pac4j-oidc, and pac4j-saml to version 6.5.6 or later immediately. Review and restrict logout redirect URL patterns to prevent open redirects. Validate all logout URLs in DefaultLogoutLogic.perform() before redirection.

Useful 0 Not Useful 0