Read the docs
TI-2020-16519 Aliases CVE-2020-27178GHSA-q39c-5vh5-vw2p

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before…

Priority LOW 35CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.

Why it matters now

EPSS 0.01219 68th percentileScored 2026-11-07
Fix Fixed org.apereo.cas:cas-server-webapp (Maven): 5.3.16, 6.1.7.2, 6.2.4org.apereo.cas:cas-server-support-otp-mfa-core (Maven): 5.3.16, 6.1.7.2, 6.2.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apereo.cas:cas-server-webapp (Maven)5.3.0 to before 5.3.165.3.16Patch availableGHSA-q39c-5vh5-vw2p
—org.apereo.cas:cas-server-webapp (Maven)6.0.0 to before 6.1.7.26.1.7.2Patch availableGHSA-q39c-5vh5-vw2p
—org.apereo.cas:cas-server-webapp (Maven)6.2.0 to before 6.2.46.2.4Patch availableGHSA-q39c-5vh5-vw2p
—org.apereo.cas:cas-server-support-otp-mfa-core (Maven)5.3.0 to before 5.3.165.3.16Patch availableGHSA-q39c-5vh5-vw2p
—org.apereo.cas:cas-server-support-otp-mfa-core (Maven)6.0.0 to before 6.1.7.26.1.7.2Patch availableGHSA-q39c-5vh5-vw2p
—org.apereo.cas:cas-server-support-otp-mfa-core (Maven)6.2.0 to before 6.2.46.2.4Patch availableGHSA-q39c-5vh5-vw2p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apereo.cas:cas-server-webapp (Maven) Vendor— Affected 5.3.0 to before 5.3.16 Fixed in 5.3.16 Patch available GHSA-q39c-5vh5-vw2p
  • org.apereo.cas:cas-server-webapp (Maven) Vendor— Affected 6.0.0 to before 6.1.7.2 Fixed in 6.1.7.2 Patch available GHSA-q39c-5vh5-vw2p
  • org.apereo.cas:cas-server-webapp (Maven) Vendor— Affected 6.2.0 to before 6.2.4 Fixed in 6.2.4 Patch available GHSA-q39c-5vh5-vw2p
  • org.apereo.cas:cas-server-support-otp-mfa-core (Maven) Vendor— Affected 5.3.0 to before 5.3.16 Fixed in 5.3.16 Patch available GHSA-q39c-5vh5-vw2p
  • org.apereo.cas:cas-server-support-otp-mfa-core (Maven) Vendor— Affected 6.0.0 to before 6.1.7.2 Fixed in 6.1.7.2 Patch available GHSA-q39c-5vh5-vw2p
  • org.apereo.cas:cas-server-support-otp-mfa-core (Maven) Vendor— Affected 6.2.0 to before 6.2.4 Fixed in 6.2.4 Patch available GHSA-q39c-5vh5-vw2p

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:*5.3.0 to before 5.3.16; 6.0.0 to before 6.1.7.2; 6.2.0 to before 6.2.4VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc1:*:*:*:*:*:*6.3.0 rc1VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc2:*:*:*:*:*:*6.3.0 rc2VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc3:*:*:*:*:*:*6.3.0 rc3VulnerableApereo
  • cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:* Versions 5.3.0 to before 5.3.16; 6.0.0 to before 6.1.7.2; 6.2.0 to before 6.2.4 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc1:*:*:*:*:*:* Versions 6.3.0 rc1 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc2:*:*:*:*:*:* Versions 6.3.0 rc2 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc3:*:*:*:*:*:* Versions 6.3.0 rc3 Vulnerable ·Apereo

Remediation

  • Fix · GHSA-q39c-5vh5-vw2p org.apereo.cas:cas-server-webapp (Maven) Fixed in 5.3.16 Advisory →
  • Fix · GHSA-q39c-5vh5-vw2p org.apereo.cas:cas-server-webapp (Maven) Fixed in 6.1.7.2 Advisory →
  • Fix · GHSA-q39c-5vh5-vw2p org.apereo.cas:cas-server-webapp (Maven) Fixed in 6.2.4 Advisory →
  • Fix · GHSA-q39c-5vh5-vw2p org.apereo.cas:cas-server-support-otp-mfa-core (Maven) Fixed in 5.3.16 Advisory →
  • Fix · GHSA-q39c-5vh5-vw2p org.apereo.cas:cas-server-support-otp-mfa-core (Maven) Fixed in 6.1.7.2 Advisory →
  • Fix · GHSA-q39c-5vh5-vw2p org.apereo.cas:cas-server-support-otp-mfa-core (Maven) Fixed in 6.2.4 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27178
  2. 2026-10-03 Alias added: GHSA-q39c-5vh5-vw2p

References

Advisory 2

Other 1

  • TI-2023-13363 LDAP password leak in Apereo CAS - GHSL-2023-009 CVSS 3.1HIGH 7.5
  • TI-2024-10382 Apereo CAS login session expiration CVSS 4.0MEDIUM 6.3
  • TI-2024-10383 Apereo CAS 2FA login improper authentication CVSS 4.0MEDIUM 5.3
  • TI-2024-10381 Apereo CAS login redirect CVSS 4.0MEDIUM 5.3
  • TI-2024-04097 CAS <= 1.0.0 - Unauthenticated SSRF CVSS 3.1CRITICAL 9.1
  • TI-2023-04254 MFA bypass in Apereo CAS CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences