EUVD-2026-68122

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

PT-2026-83445

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest. When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned...

EUVD-2026-39091

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's SAML integration does not verify the signature on inbound LogoutRequest messages. An unauthenticated remote attacker who knows a...

Fedora 16 : php-pear-CAS-1.3.0-2.fc16 (2012-4119)

Upstream changelog Changes in version 1.3.0 Bug Fixes : - the saml logout url should be parsed urlencoded 24 dlineate - fix a proxy mode bug introduced in a previous comitt 16 Adam Franco - Fix includepath order so that the phpCAS path takes precedence 13 Adam Franco - fix invalid characters in t...