Description

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-29T17:17:58.640Z",
  "pubdate": "2026-08-29T17:17:58.640Z",
  "executiveSummary": "An open redirect vulnerability exists in the pac4j-core library, specifically within the DefaultLogoutLogic.perform() function, affecting versions prior to 6.5.6.\nThe vulnerability stems from improper validation of redirect targets, where the application allows backslash-prefixed strings to bypass security filters intended to enforce domain restrictions via logoutUrlPattern.\nAn attacker can exploit this flaw to craft malicious logout links that, when accessed by a victim, lead to unauthorized external redirection.\nThis impact allows for phishing attacks, credential harvesting, or the delivery of malicious content by masquerading as a trusted service following a user's logout event.\nThe vulnerability is accessible to unauthenticated remote attackers who can influence the target URL parameter provided to the affected logout endpoint.\nSuccessful exploitation requires the victim to click a specially crafted URL, making this a client-side execution vector that relies on social engineering or malicious link distribution.",
  "technicalDetails": "The vulnerability is located in the DefaultLogoutLogic.perform() method of the pac4j-core library. This function is responsible for handling user logout flows and redirecting the user to a specified URL after the session has been invalidated.\nThe root cause is a failure in the validation logic when comparing the requested redirect target against the configured logoutUrlPattern. The library fails to account for how modern web browsers handle and normalize URI strings containing leading backslashes.\nSpecifically, when a URL is provided with a backslash prefix, the browser may interpret the string as a network-path reference (e.g., //attacker.com). Because the backslash character can bypass regex-based security filters or simple string comparisons used in logoutUrlPattern, the library incorrectly identifies the input as a safe, relative path.\nAttack flow: 1) The attacker constructs a URL containing the logout endpoint, injecting a parameter with a backslash-prefixed URI (e.g., /logout?url=\\attacker.com). 2) The application’s DefaultLogoutLogic.perform() method validates this input against the logoutUrlPattern. Due to the backslash handling discrepancy, the validation check returns true, incorrectly validating the malicious host as an allowed destination. 3) The application generates a redirect response containing the attacker-controlled URI. 4) The victim's browser, upon receiving the response, normalizes the backslash into a valid protocol-relative URL, causing the browser to navigate to the attacker's server.\nThe vulnerability allows an attacker to control the final landing page of a user's logout sequence. Because the redirect originates from a trusted domain, the victim is significantly more likely to trust the target site, facilitating sophisticated phishing campaigns or malicious content delivery.\nAffected versions include all releases of pac4j-core prior to 6.5.6. The issue is categorized as an improper input validation vulnerability where the normalization process at the browser level effectively breaks the security constraints applied by the application layer logic."
}