CVE-2026-82465: PAC4J

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.

Affected products

• PAC4J PAC4J: before 6.5.6 (fixed in 6.5.6)

Published 2026-08-29. Last modified 2026-09-10.