Your vulnerability doesn't do anything in practice.
Conor already explained in his answer that Login CSRF doesn't really exist, but I think that's not the full story.
You mentioned a self-XSS vulnerability in the profile, which leads me to believe that your attack vector looks as follows:
Lure the victim to your site
Abuse a CSRF vulnerability to log the ...
Yep, indeed the scenario is enough to say that the web app is vulnerable to Login/Logout CSRF.
ViewState and EventValidation are not meant to protect against CSRF (I guess it's a .net/asp(x) application).
ViewState is used to track and restore the state values of controls
that would otherwise be lost, either because those values do not post
with the ...