CVE-2026-82465 - pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest
Brief
CVE ID : CVE-2026-82465
Published : Aug. 29, 2026, 5:17 p. m.
- 3 hours, 57 minutes ago
Description : pac4j-saml before 6.
- 6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator. validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e. g.
, an email address used as NameID) to terminate a victim's SAML session.
Severity: 5.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...