CVE-2026-82464: PAC4J

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.

Affected products

• PAC4J PAC4J: before 6.5.6 (fixed in 6.5.6)

Published 2026-08-29. Last modified 2026-09-10.