CVE-2026-82464

Name of the Vulnerable Software and Affected Versions pac4j-core versions prior to 6.5.6

Description An open redirect issue exists in the DefaultLogoutLogic.perform() function. The system accepts logout redirect targets that start with a backslash and match the logoutUrlPattern. This allows attackers to create logout links containing backslash-prefixed external hosts, which browsers normalize into network-path references, leading users to attacker-controlled websites after the logout process.

Recommendations Update pac4j-core to version 6.5.6 or later.