Jasig CAS Client vulnerabilities

1 known vulnerability in Jasig CAS Client from Apereo. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  Java Apereo CAS Client: Improper Validation of Certificate with Host Mismatch

  CVE-2026-15243Jul 24, 2026Apereo

  Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-sig