CVE-2026-82465

pac4j-saml versions before 6.5.6 fail to enforce signature validation on SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP does not send a SessionIndex, the session can be destroyed based solely on the NameID. This allows an unauthenticated attacker to submi...