Read the docs
TI-2026-12832 Aliases CVE-2026-15243GHSA-52jg-6vw4-42p8

Improper Validation of Certificate in CAS Client

Priority LOW 32CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.  Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApereoJava Apereo CAS Client4.1.0—No fix listedCNA
ApereoJasig CAS Client3.6.4—No fix listedCNA
  • Java Apereo CAS Client VendorApereo Affected 4.1.0 Fixed in — No fix listed CNA
  • Jasig CAS Client VendorApereo Affected 3.6.4 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15243
  2. 2026-10-03 Alias added: GHSA-52jg-6vw4-42p8

References

Advisory 1

Other 1

  • TI-2026-42279 Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure CVSS 4.0CRITICAL 9.3
  • TI-2026-25433 Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2023-13363 LDAP password leak in Apereo CAS - GHSL-2023-009 CVSS 3.1HIGH 7.5
  • TI-2024-10382 Apereo CAS login session expiration CVSS 4.0MEDIUM 6.3
  • TI-2024-10383 Apereo CAS 2FA login improper authentication CVSS 4.0MEDIUM 5.3
  • TI-2024-10381 Apereo CAS login redirect CVSS 4.0MEDIUM 5.3
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences