diff --git a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
index ef34f792b..72aa56d91 100755
--- a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
+++ b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
@@ -66,7 +66,10 @@ protected override void Configure(ConfigureAuthenticationContext<WsFederationOpt
                 ctx.Request.Path == ctx.Options.CallbackPath &&
                 ctx.Request.Query.ContainsKey(identityServerOptions.UserInteraction.LogoutIdParameter))
             {
-                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + "?" + identityServerOptions.UserInteraction.LogoutIdParameter + "=" + ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter]);
+                // Redirect only to the local logout page; the logout id is URL-encoded so it cannot alter the target.
+                var logoutId = ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter].ToString();
+                var query = QueryString.Create(identityServerOptions.UserInteraction.LogoutIdParameter, logoutId);
+                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + query.ToUriComponent());
                 ctx.HandleResponse();
             }
 
diff --git a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
index ef34f792b..72aa56d91 100755
--- a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
+++ b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
@@ -66,7 +66,10 @@ protected override void Configure(ConfigureAuthenticationContext<WsFederationOpt
                 ctx.Request.Path == ctx.Options.CallbackPath &&
                 ctx.Request.Query.ContainsKey(identityServerOptions.UserInteraction.LogoutIdParameter))
             {
-                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + "?" + identityServerOptions.UserInteraction.LogoutIdParameter + "=" + ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter]);
+                // Redirect only to the local logout page; the logout id is URL-encoded so it cannot alter the target.
+                var logoutId = ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter].ToString();
+                var query = QueryString.Create(identityServerOptions.UserInteraction.LogoutIdParameter, logoutId);
+                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + query.ToUriComponent());
                 ctx.HandleResponse();
             }