pac4j-saml does not validate the signature on SAML LogoutRequest messages in its SAML2LogoutValidator.validateLogoutRequest() method. The result is that an unauthenticated attacker can submit an unsigned LogoutRequest containing a guessed NameID, such as a victim’s email address, and if the IdP does not provide a SessionIndex the request will terminate the victim’s session. This allows the attacker to force the victim to lose an active session and effectively deny service to the user or application, without gaining any code execution or persistent access.

The vulnerability affects the pac4j library, specifically pac4j-saml versions prior to 6.5.6. Systems running pac4j-saml 6.5.5 or earlier are potentially impacted; versions 6.5.6 and later include the fix.

The CVSS score of 6.9 indicates a moderate impact, and the lack of an EPSS score suggests limited data on exploitation frequency. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to guess or obtain the target’s NameID and send an unsigned LogoutRequest over the network. Because the attack does not require authentication, the risk of denial of service is significant, but it does not grant remote code execution or privilege escalation.