Executive brief
The Apereo CAS Client, a library used to integrate applications with Central Authentication Service (CAS) for single sign-on, fails to properly verify that a security certificate belongs to the specific server it is communicating with. An attacker positioned between the user and the server (such as on a public Wi-Fi or via DNS spoofing) could present a fake but otherwise valid certificate to intercept login data. This allows the attacker to hijack user sessions and gain unauthorized access to protected business applications.
Technical details
The Apereo CAS Client (Java and Jasig versions) is vulnerable to improper certificate validation (CWE-297). The client accepts any certificate signed by a trusted Certificate Authority (CA) even if the hostname on the certificate does not match the destination server, provided the URL matches a configured allowlist or regular expression. An attacker capable of performing a Man-in-the-Middle (MITM) attack—via DNS poisoning, rogue access points, or malicious proxies—can present a valid CA-signed certificate for an arbitrary domain to intercept the CAS exchange. This allows the attacker to capture the Ticket-Granting Ticket (TGT) and subsequently obtain Service Tickets to impersonate the victim. Vulnerabilities are confirmed in Java Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4.
Affected products
- Apereo Java Apereo CAS Client 4.1.0
- Apereo Jasig CAS Client 3.6.4
Timeline
- 2026-07-24: disclosed: Vulnerability disclosed by CERT Polska after unsuccessful attempts to contact maintainers.
- 2026-07-24: advisory