Executive brief
pac4j-saml is a Java security library that handles SAML authentication and logout for web applications. Before version 6.5.6, it fails to validate the digital signature on SAML logout requests when no session index is provided. An attacker can exploit this by sending a forged logout request with only a guessed username (such as an email address) to forcibly log out legitimate users, disrupting their sessions without authentication.
Technical details
The vulnerability is a missing cryptographic signature validation in the SAML2LogoutValidator.validateLogoutRequest() method. When an Identity Provider (IdP) does not include a SessionIndex attribute in the SAML LogoutRequest message, the validator accepts logout based solely on the NameID field without checking the message's cryptographic signature. An unauthenticated attacker can craft an unsigned SAML LogoutRequest with a guessed NameID (e.g., a common email address) and submit it over the network to terminate any active SAML session associated with that identifier. The attack requires network access to the vulnerable application and knowledge of a valid NameID format, but no authentication. A patch is available in version 6.5.6 and later.
Affected products
- pac4j pac4j-saml before 6.5.6
Timeline
- 2026-08-29: disclosed