CVE-2026-82464

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...

PT-2026-83444

Name of the Vulnerable Software and Affected Versions pac4j-core versions prior to 6.5.6 Description An open redirect issue exists in the DefaultLogoutLogic.perform function. The system accepts logout redirect targets that start with a backslash and match the logoutUrlPattern. This allows attacke...