Read the docs
TI-2023-04254 Aliases CVE-2023-4612GHSA-fxgj-cfm7-w8hw

MFA bypass in Apereo CAS

Priority MEDIUM 44CWE-302Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01115 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Apereo FoundationCASup to 7.0.0-RC7—No fix listedCNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:*before 7.0.0VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc1:*:*:*:*:*:*7.0.0 rc1VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc2:*:*:*:*:*:*7.0.0 rc2VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc3:*:*:*:*:*:*7.0.0 rc3VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc4:*:*:*:*:*:*7.0.0 rc4VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc5:*:*:*:*:*:*7.0.0 rc5VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc6:*:*:*:*:*:*7.0.0 rc6VulnerableApereo
cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc7:*:*:*:*:*:*7.0.0 rc7VulnerableApereo
  • cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:* Versions before 7.0.0 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc1:*:*:*:*:*:* Versions 7.0.0 rc1 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc2:*:*:*:*:*:* Versions 7.0.0 rc2 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc3:*:*:*:*:*:* Versions 7.0.0 rc3 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc4:*:*:*:*:*:* Versions 7.0.0 rc4 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc5:*:*:*:*:*:* Versions 7.0.0 rc5 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc6:*:*:*:*:*:* Versions 7.0.0 rc6 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:central_authentication_service:7.0.0:rc7:*:*:*:*:*:* Versions 7.0.0 rc7 Vulnerable ·Apereo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-4612
  2. 2026-10-03 Alias added: GHSA-fxgj-cfm7-w8hw

References

Advisory 2

  • TI-2026-47769 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker CVSS 4.0HIGH 8.7
  • TI-2026-82261 OS command injection in openEQUELLA via system.execute CVSS 4.0CRITICAL 9.4
  • TI-2026-82264 Unauthenticated access to user details in openEQUELLA CVSS 4.0MEDIUM 6.9
  • TI-2026-82263 XML external entity injection in openEQUELLA allows file reads CVSS 4.0HIGH 7.1
  • TI-2026-82262 XML external entity injection in openEQUELLA SOAP API lets attackers read files CVSS 4.0MEDIUM 6.1
  • TI-2026-82265 Stored XSS in openEQUELLA pre-login notice via legacy logon page CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences