Open Redirect

Overview org.pac4j:pac4j-core is a pac4j is an easy and powerful security engine for Java to authenticate users, get their profiles and manage authorizations in order to secure web applications and web services. Affected versions of this package are vulnerable to Open Redirect in the perform...

CVE-2026-82464

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

CVE-2026-82464 pac4j-core before 6.5.6 Open Redirect via Backslash Logout

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

CVE-2026-82464 pac4j-core before 6.5.6 Open Redirect via Backslash Logout

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

CVE-2026-82464

pac4j-core versions before 6.5.6 are affected by an open redirect vulnerability in the DefaultLogoutLogic.perform() method. The component accepts backslash-prefixed logout redirect targets that match the configured logoutUrlPattern. Because browsers normalize a backslash into a network-path refer...

EUVD-2026-68121

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

PT-2026-83444

Name of the Vulnerable Software and Affected Versions pac4j-core versions prior to 6.5.6 Description An open redirect issue exists in the DefaultLogoutLogic.perform function. The system accepts logout redirect targets that start with a backslash and match the logoutUrlPattern. This allows attacke...