Vulnerability · Published Aug 29, 2026 · Assigned by VulnCheck

CVE-2026-82465pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest

Medium 5.3

In plain English

A medium-severity insufficient verification of data authenticity in pac4j from pac4j. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 81.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.

Affected products (as reported)

Vendor	Product	Versions
pac4j	pac4j	0 – before 6.5.6

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Patch Commit patch
pac4j Security Advisory for pac4j-core, pac4j-oidc and pac4j-saml vendor-advisory
https://github.com/pac4j/pac4j/blob/pac4j-parent-6.5.5/pac4j-saml/src/main/java/org/pac4j/saml/logout/impl/SAML2LogoutValidator.java technical-description
https://github.com/pac4j/pac4j product
VulnCheck Advisory: pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest third-party-advisory