Is CVE-2026-82464 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82464?

CVE-2026-82464 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-82464

Description

pac4j-core before 6.5.6 contains an open redirect vulnerability in DefaultLogoutLogic.perform() that accepts backslash-prefixed logout redirect targets matching logoutUrlPattern. Attackers can craft logout links with backslash-prefixed external hosts that browsers normalize into network-path references, redirecting victims to attacker-controlled sites after logout.