# CVE-2026-82464

## Summary

- **CVE ID:** CVE-2026-82464
- **Severity:** MEDIUM
- **CVSS Score:** 6.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N)
- **CWE:** CWE-601
- **Published:** Aug 29, 2026
- **Last Modified:** Sep 1, 2026

## Description

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.

## Affected Products

- pac4j — pac4j (0)

## References

- [CNA](https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e)
- [CNA](https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html)
- [CNA](https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-core/src/main/java/org/pac4j/core/engine/DefaultLogoutLogic.java)
- [CNA](https://github.com/pac4j/pac4j)
- [CNA](https://www.vulncheck.com/advisories/pac4j-core-before-6.5.6-open-redirect-via-backslash-logout)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.20%
- **EPSS Percentile:** 9.9

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-12._