Open Redirect

pac4j-core is vulnerable to open redirect. The vulnerability is due to DefaultLogoutLogic.perform accepting backslash-prefixed logout redirect targets matching logoutUrlPattern, where attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path...