Is CVE-2026-82465 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82465 being exploited in the wild.

How severe is CVE-2026-82465?

Medium severity, with a CVSS score of 5.3, published 29 August 2026.

Is there a fix for CVE-2026-82465?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82465 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82465?

Check whether you run Pac4j-Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82465: pac4j-saml missing SAML LogoutRequest signature validation

CVE-2026-82465 · Severity: medium · CVSS 5.3 · Published 2026-08-29

pac4j-saml is a Java security library that handles SAML authentication and logout for web applications. Before version 6.5.6, it fails to validate the digital signature on SAML logout requests when no session index is provided. An attacker can exploit this by sending a forged logout request with only a guessed username (such as an email address) to forcibly log out legitimate users, disrupting their sessions without authentication.

Vendors: Pac4j.

Quick answers

Is CVE-2026-82465 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82465 being exploited in the wild.
How severe is CVE-2026-82465?: Medium severity, with a CVSS score of 5.3, published 29 August 2026.
Which products and versions are affected?: Pac4j-Saml before 6.5.6.
Is there a fix for CVE-2026-82465?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82465 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82465?: Check whether you run Pac4j-Saml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing cryptographic signature validation in the SAML2LogoutValidator.validateLogoutRequest() method. When an Identity Provider (IdP) does not include a SessionIndex attribute in the SAML LogoutRequest message, the validator accepts logout based solely on the NameID field without checking the message's cryptographic signature. An unauthenticated attacker can craft an unsigned SAML LogoutRequest with a guessed NameID (e.g., a common email address) and submit it over the network to terminate any active SAML session associated with that identifier. The attack requires network access to the vulnerable application and knowledge of a valid NameID format, but no authentication. A patch is available in version 6.5.6 and later.

Affected products

pac4j pac4j-saml before 6.5.6

Timeline

2026-08-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.