pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Pac4j Pac4j
cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*
|
— |
6.5.6
|
References 5
https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e
Patch Commit
https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-core/src/main/java…
NVD
https://github.com/pac4j/pac4j
NVD
https://www.vulncheck.com/advisories/pac4j-core-before-6.5.6-open-redirect-via-…
VulnCheck Advisory: pac4j-core before 6.5.6 Open Redirect via Backslash Logout