Apereo Foundation vulnerabilities
We track 4 vulnerabilities in Apereo Foundation products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest Apereo Foundation vulnerabilities
- 7.1 High severity
openEQUELLA: Improper Restriction of XML External Entity Reference
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to
- 9.4 Critical severity
openEQUELLA: Improper Neutralization of Special Elements used in an OS Command
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbi
- 8.8 High severity
openEQUELLA: Incomplete List of Disallowed Inputs
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass
- 9.8 Critical severity
CAS: Improper Authentication
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fix