pac4j-core EUVD-2026-68121

Exploitation requires the victim to follow a crafted logout URL containing a backslash-prefixed redirect parameter - attacker-controlled delivery of such a link via email, SMS, or embedded hyperlink is the prerequisite. The target application must run pac4j-core prior to 6.5.6 with logout functionality exposed via a URL that accepts a redirect parameter. The logoutUrlPattern (whether default or custom) must not independently exclude backslash characters. No attacker authentication is required (PR:N per CVSS 4.0 vector). Exploitation is limited by the user-interaction requirement: automated mass exploitation without victim clicks is not possible. Deployment on any major browser is sufficient, as all normalize backslash to forward slash in URL path resolution.

The CVSS 4.0 score of 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P accurately reflects the real-world risk profile: network-exploitable with no attacker authentication required and low attack complexity, but contingent on victim interaction (clicking a crafted logout link). No EPSS data was provided in the source intelligence. The vulnerability is not listed in CISA KEV, and no public proof-of-concept exploit has been identified, indicating no confirmed mass exploitation at time of analysis. The impact is constrained to low-level confidentiality and integrity effects - consistent with redirect-based phishing rather than direct system compromise. Open redirects carry meaningful downstream risk for credential harvesting campaigns, and the low complexity of crafting a malicious logout URL means any organization running an unpatched version should treat patching as routine-but-prompt rather than emergency response. The absence of a KEV listing is a favorable signal but does not eliminate risk, as open redirects are frequently exploited in targeted phishing rather than broad automated scanning.

An attacker sends a victim a crafted logout link such as 'https://app.example.com/logout?url=\attacker-phishing.com'. The victim clicks the link, pac4j validates the backslash-prefixed URL against the regex (which passes because backslash is not excluded), destroys the session, and issues a redirect response. The browser normalizes the backslash into a network-path reference and navigates the victim to the attacker's site, where a cloned login page harvests credentials. No public proof-of-concept code has been identified at time of analysis.