Apereo vulnerabilities
We track 9 vulnerabilities in Apereo products across 6 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on July 24, 2026.
Latest Apereo vulnerabilities
- 7.4 High severity
Java Apereo CAS Client: Improper Validation of Certificate with Host Mismatch
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-sig
- 9.1 Critical severity
cas: Reusing a Nonce, Key Pair in Encryption
Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect mu
- 7.5 High severity
CAS: Uncontrolled Resource Consumption
A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfiguration
- 7.5 High severity
CAS: Improper Control of Generation of Code
A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Affected by this issue is the function saveService of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\RegisteredServiceSimpleF
- 9.8 Critical severity
CAS: Improper Authentication
A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. Th
- 8.1 High severity
A vulnerability was found in Apereo CAS 6.6 and classified as problematic.
A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an
- 9.8 Critical severity
CAS: Improper Authentication
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fix
- 7.5 High severity
CAS: Insufficiently Protected Credentials
Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_cli
- 8.0 High severity
phpCAS: Improper Control of Resource Identifiers
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker