Executive brief
pac4j-core is an authentication and authorization library used by Java applications to manage user login and logout. The vulnerability allows attackers to craft malicious logout links that redirect users to attacker-controlled websites after they log out, potentially leading to credential theft or malware distribution.
Technical details
pac4j-core before version 6.5.6 contains an open redirect vulnerability in the DefaultLogoutLogic.perform() method. The vulnerability occurs because the logout redirect validation logic fails to properly sanitize backslash-prefixed URLs (e.g., \\\attacker.com), which browsers normalize into network-path references (//attacker.com). An attacker can craft a logout link with a backslash-prefixed external host that passes the logoutUrlPattern validation and redirects victims to an attacker-controlled site after logout. No authentication is required; the attack vector is network-based through a crafted logout URL. The vulnerability was fixed in version 6.5.6.
Affected products
- pac4j pac4j-core before 6.5.6
Timeline
- 2026-08-29: disclosed