Skip to content
OpenAdvisories

Vendor

pac4j

9 known vulnerabilities.

Products

pac4j 8 pac4j-jwt 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-82465

    pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

    pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated…

    pac4j pac4j
  • Medium 6.1
    CVE-2026-82464

    pac4j-core before 6.5.6 Open Redirect via Backslash Logout

    pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that bro…

    pac4j pac4j
  • Medium 6.5
    CVE-2026-82462

    pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution

    pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, n…

    pac4j pac4j