EUVD-2026-68122
GHSA-r76c-m8xx-m685
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated SLO endpoint; no privileges needed; impact is solely session availability loss with no confidentiality or integrity breach.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.
AnalysisAI
Session termination via unsigned SAML LogoutRequest in pac4j-saml before 6.5.6 allows unauthenticated remote attackers to destroy any active SAML session by submitting a forged, unsigned LogoutRequest containing a guessed NameID (e.g., an email address used as the SAML subject identifier) when the IdP omits a SessionIndex. The root cause is that SAML2LogoutValidator.validateLogoutRequest() did not enforce signature validation in this code path, permitting the NameID alone to trigger session destruction without any cryptographic proof of IdP origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses pac4j-saml in a version prior to 6.5.6 and has a SAML Single Logout (SLO) endpoint exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, score 6.9) accurately reflects the attack surface: network-reachable, zero authentication, low complexity, but limited in impact to vulnerable-system availability (session termination). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade pac4j-saml to version 6.5.6 or later; the vendor-released patch is confirmed via the advisory at https://www.pac4j.org/blog/security-advisory-pac4j-core-oidc-saml.html and the fix commit at https://github.com/pac4j/pac4j/commit/2270c3ff70e93cc43831e75702acd5135531237e. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
LDAP injection vulnerabilities in PAC4J authentication library allow low-privileged remote attackers to execute arbitrar
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access reso
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim
CSRF protection bypass in PAC4J authentication library allows remote attackers to forge state-changing requests without
Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sess
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker
The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today