The vulnerability resides in pac4j-core’s DefaultLogoutLogic and is a CWE‑601: Open Redirect flaw, where a backslash‑prefixed logout redirect target falls within a configured pattern. When a user logs out, the framework accepts the redirect URL, and browsers normalize the backslash‑prefixed external host into a network‑path reference. This behavior can be abused to redirect users to sites chosen by an attacker, enabling phishing, credential harvesting, or other social‑engineering attacks.

It affects all installations of the pac4j pac4j library older than version 6.5.6. If an application uses pac4j-core before that version, any configured logoutUrlPattern that tolerates backslash‑prefixed values is vulnerable.

The CVSS score of 5.3 points to moderate severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV database, suggesting limited widespread exploitation to date. The exploitation requires an attacker to supply a crafted logout link that a victim will click, making user interaction a prerequisite. Once triggered, the attacker can redirect the victim to a malicious domain, compromising user trust and potentially credential integrity.