Back to overview

CVE-2026-15243

HIGH
7.4
CVSS 4.0
Description
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.  Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.

Metadata

CVE ID
CVE-2026-15243
State
PUBLISHED
Assigner
CERT-PL
Reserved
2026-07-09 11:56 UTC
Published
2026-07-24 11:29 UTC
Last updated
2026-07-24 12:33 UTC
Primary CWE
CWE-297
CWE-297 Improper validation of certificate with host mismatc…
Vendor / Product
Apereo / Java Apereo CAS Client
Sources
cve.org  ·  NVD

Severity & Metrics

7.4 HIGH CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (2)
VendorProductPlatformVersions
Apereo Jasig CAS Client — 3.6.4
Apereo Java Apereo CAS Client — 4.1.0
Weakness (CWE)
CWESourceDescription
CWE-297 cna CWE-297 Improper validation of certificate with host mismatch
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.4 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References (2)
Back to overview