Origin Validation Error

Overview org.pac4j:pac4j-saml is an is PAC4J package for the SAML Protocol. Affected versions of this package are vulnerable to Origin Validation Error via the validateLogoutRequest function. An attacker can terminate a victim's session by submitting an unsigned LogoutRequest with a guessed...

CVE-2026-82465

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465

pac4j-saml versions before 6.5.6 fail to enforce signature validation on SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP does not send a SessionIndex, the session can be destroyed based solely on the NameID. This allows an unauthenticated attacker to submi...

EUVD-2026-68122

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

PT-2026-83445

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465: Insufficient Verification of Data Authenticity

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

org.pac4j:pac4j-cas (1.7.2), org.pac4j:pac4j-gae (1.7.2) +6 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.7.2)

org.pac4j:pac4j-core MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.7.2 - org.pac4j:pac4j-gae 1.7.2 - org.pac4j:pac4j-http 1.7.2 - org.pac4j:pac4j-oauth 1.7.2 -...

EUVD-2019-0762

Malware in sbrugna...

CVE-2019-10755

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

org.pac4j:pac4j-cas (1.7.2), org.pac4j:pac4j-gae (1.7.2) +6 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (1.7.2)

org.pac4j:pac4j-core MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.7.2 - org.pac4j:pac4j-gae 1.7.2 - org.pac4j:pac4j-http 1.7.2 - org.pac4j:pac4j-oauth 1.7.2 -...

org.jasig.cas:cas-server-support-pac4j (>=4.2.0-rc1, <=4.2.1), org.jasig.cas:cas-server-support-pac4j-webflow (>=4.2.0-rc1, <=4.2.1) +1 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.8.2)

org.pac4j:pac4j-saml MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.jasig.cas:cas-server-support-pac4j =4.2.0-rc1, =4.2.0-rc1, =4.2.1 - org.pac4j:pac4j-config 1.8.2 Source cves:...

org.jooby:coverage-report (>=0.13.0, <=0.16.0), org.pac4j:pac4j-config (1.8.1) potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.8.1)

org.pac4j:pac4j-saml MAVEN version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.jooby:coverage-report =0.13.0, =0.16.0 - org.pac4j:pac4j-config 1.8.1 Source cves: CVE-2019-10755 Source advisory:...

org.jenkins-ci.plugins:saml (>=0.12, <=0.14) potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.6.0)

org.pac4j:pac4j-saml MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.jenkins-ci.plugins:saml =0.12, =0.14 Source cves: CVE-2019-10755 Source advisory: OSV:GHSA-RC75-CF5C-MXVH...

org.apereo.cas:cas-management-webapp-configuration (>=5.3.1, <=5.3.3), org.apereo.cas:cas-management-webapp-support (>=5.3.1, <=5.3.3) +232 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (>=3.0.0-rc2, <=3.1.0)

org.pac4j:pac4j-saml MAVEN version =3.0.0-rc2, =5.3.1, =5.3.1, =5.3.1, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.3 and more Source cves: CVE-2019-10755 Source advisory: GHSA-RC75-CF5C-MXVH...

com.jetdrone:yoke.middleware.pac4j (>=2.0.1, <=2.0.21) potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.5.1)

org.pac4j:pac4j-saml MAVEN version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - com.jetdrone:yoke.middleware.pac4j =2.0.1, =2.0.21 Source cves: CVE-2019-10755 Source advisory: OSV:GHSA-RC75-CF5C-MXVH...

org.pac4j:pac4j-config (1.9.3) potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.9.3)

org.pac4j:pac4j-saml MAVEN version 1.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.pac4j:pac4j-config 1.9.3 Source cves: CVE-2019-10755 Source advisory: OSV:GHSA-RC75-CF5C-MXVH...