CVE-2026-82465 pac4j-saml before 6.5.6 Session Destruction via Unsigned LogoutRequest
An unauthenticated attacker can terminate a victim's SAML session by sending an unsigned LogoutRequest with a guessed identifier, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82465?
CVE-2026-82465 is a medium-severity vulnerability in pac4j, published on 29 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in SAML2LogoutValidator.validateLogoutRequest(). When an IdP sends no SessionIndex, a session can be destroyed based solely on the NameID, allowing an unauthenticated attacker to submit an unsigned LogoutRequest with a guessed identifier (e.g., an email address used as NameID) to terminate a victim's SAML session.
Weakness: CWE-345
Which versions are affected by CVE-2026-82465?
How do I fix CVE-2026-82465?
No fix has been published for CVE-2026-82465 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82465 being exploited?
There is no known exploitation of CVE-2026-82465 in the wild and no public exploit code.
Sources
Also known as GHSA-r76c-m8xx-m685.