CVE-2026-82464 in pac4j
Summary
by MITRE • 08/29/2026
pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2026
The pac4j-core library, a widely adopted authentication and authorization framework for Java-based web applications, contained a critical open redirect vulnerability in versions prior to 6.5.6 within the DefaultLogoutLogic.perform() method. This flaw stems from an insufficient validation mechanism when processing logout redirect targets that are intended to match a configured logoutUrlPattern. The core issue lies in how the application handles URL normalization and pattern matching logic, specifically failing to account for browser-specific parsing behaviors regarding backslash characters. When a user initiates a logout sequence, the framework is expected to validate the target destination against an allowlist or regex pattern defined by the administrator. However, the implementation did not adequately sanitize inputs that contained leading backslashes before external hostnames.
From a technical perspective, this vulnerability exploits the discrepancy between server-side string matching and client-side URL resolution standards. According to RFC 3986, which defines Uniform Resource Identifier (URI) syntax, a URI reference starting with two slashes is typically interpreted as a network-path reference, pointing directly to a host. However, many web browsers exhibit legacy or non-standard behavior where they normalize URLs containing backslashes by treating them similarly to forward slashes in certain contexts, particularly when resolving relative paths or during form submissions and link clicks. By crafting a logout URL with a single leading backslash followed by two forward slashes (e.g., \//evil.com), an attacker can bypass the server-side regex check if it expects standard forward-slash prefixed URLs. The server perceives this as potentially matching the internal pattern due to loose string comparison or incomplete normalization, while the browser interprets it as a redirect to the external domain evil.com after the logout session is terminated.
The operational impact of this vulnerability allows for sophisticated phishing and account takeover attacks. Since the redirection occurs immediately following the logout process, victims are stripped of their authentication tokens and session state before being sent to an attacker-controlled site. This timing makes it difficult for users to realize they have been compromised until after they interact with the malicious page. Attackers can leverage this redirect to host convincing clones of legitimate login pages, harvesting credentials from unsuspecting users who believe they are logging into a trusted service again. Furthermore, because the redirection happens post-logout, traditional session fixation protections may not apply in the expected manner, and the user's trust in the original application is exploited to facilitate further social engineering attacks.
This vulnerability aligns with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect), a common web security weakness where an application redirects users to URLs provided by untrusted sources without proper validation. In terms of offensive tactics, this technique corresponds to the ATT&CK Tactic TA0005: Defense Evasion and specifically relates to techniques involving browser-based redirections used in phishing campaigns such as those categorized under T1566.002 (Phishing: Spearphishing Link). The lack of strict canonicalization allows attackers to bypass basic security controls that rely on simple string matching against allowlists, highlighting the importance of robust URL parsing libraries and normalization routines in web frameworks.
To mitigate this vulnerability, organizations using pac4j-core must upgrade immediately to version 6.5.6 or later, where the DefaultLogoutLogic.perform() method has been patched to correctly handle backslash characters and enforce strict canonicalization before pattern matching. Developers should also implement defense-in-depth strategies by validating redirect URLs against a whitelist of allowed domains rather than relying solely on regex patterns that may be susceptible to normalization bypasses. Additionally, implementing Content Security Policy (CSP) directives can help mitigate the impact of open redirects by restricting where forms and scripts can submit data or navigate users. Regular security audits focusing on URL handling logic in authentication flows are essential to prevent similar exploitation vectors in other components of the application stack.