Description

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-29T17:17:58.773Z",
  "pubdate": "2026-08-29T17:17:58.773Z",
  "executiveSummary": "A critical security vulnerability exists in the pac4j-saml library before version 6.5.6, concerning the improper validation of SAML LogoutRequest messages.\nThe vulnerability is identified as a signature validation bypass within the SAML2LogoutValidator component, which fails to enforce cryptographic verification for LogoutRequest packets.\nAn unauthenticated, remote attacker can leverage this flaw to perform a Denial of Service (DoS) attack against arbitrary user sessions.\nBy crafting an unsigned LogoutRequest containing a known or guessed NameID, an attacker can trigger the termination of a victim's active session without requiring valid authentication or access to the identity provider (IdP).\nThe risk is elevated due to the ease of exploitation, as no prior session state or cryptographic material is required from the attacker to initiate the logout flow.\nImpact includes broad service disruption, unauthorized termination of user sessions, and potential degradation of user experience and security state for integrated applications.",
  "technicalDetails": "The root cause of the vulnerability resides in the SAML2LogoutValidator.validateLogoutRequest() function within the pac4j-saml library.\nThe validator fails to mandate signature verification for incoming SAML LogoutRequest messages. In the context of SAML 2.0, signature validation is a critical security control intended to ensure that logout requests originate from a trusted Identity Provider (IdP).\nThe implementation specifically fails to enforce verification when the IdP omits a SessionIndex in the request. Under these conditions, the library proceeds to validate and process the request based solely on the NameID attribute.\nThe attack flow begins when an attacker crafts a malicious, unsigned LogoutRequest XML document. This document specifies the target user's identity via the NameID field. Because the validator ignores the absence of a signature, it treats the unauthenticated, user-supplied request as a legitimate command from the IdP.\nUpon receiving this request, the affected component processes the instruction and terminates the corresponding session associated with that NameID. Since the NameID is often predictable—such as a common email address or a sequential identifier—the attacker can target specific users or iterate through a list of identifiers to perform a mass logout.\nThis vulnerability is classified as an authentication bypass or session termination flaw, effectively allowing an attacker to manipulate session states without being an authorized IdP. No special privileges are required, and the attack can be executed over any network path that allows the submission of LogoutRequest messages to the application's SAML endpoint.\nThe exploitation does not require the attacker to compromise the IdP or have valid session tokens. It strictly relies on the application's failure to verify the authenticity of the LogoutRequest, allowing the injection of unauthorized session-ending commands. Successful exploitation forces the victim's application state to 'logged out,' requiring the user to re-authenticate, thereby facilitating a persistent Denial of Service.\nThis behavior exposes a fundamental breakdown in the SAML assertion processing logic where trust is implicitly granted to incoming messages regardless of cryptographic integrity."
}