Junglewise Threat Intelligence

CVE-2026-59099: Apereo CAS AES-GCM nonce reuse in webflow execution tokens

CVE-2026-59099 · Severity: critical · CVSS 9.1 · Published 2026-07-02

Executive brief

Apereo CAS, a widely used single sign-on solution, contains a cryptographic flaw in how it handles authentication session data. An unauthenticated attacker can exploit this to decrypt sensitive login flow information, potentially leading to the exposure of user credentials or session hijacking. This affects the default configuration used by most organizations to manage user logins.

Technical details

A cryptographic vulnerability exists in Apereo CAS due to the reuse of a fixed all-zero Initialization Vector (IV) with the same encryption key in AES-GCM mode. This occurs within the BaseBinaryCipherExecutor used for managing client-side webflow execution tokens. A remote, unauthenticated attacker can collect multiple tokens from the login page and perform known-plaintext analysis to recover the keystream and decrypt the webflow conversation state. The issue is fixed in version 7.3.7.3 and 8.0.0-RC6 by ensuring nonces are properly renewed/randomized.

Affected products

  • Apereo CAS 7.3.0 before 8.0.0-RC6

Timeline

  • 2026-06-16: disclosed: Reported to the CAS project
  • 2026-06-17: patched: Fix committed to repository
  • 2026-06-18: advisory: Initial vulnerability disclosure and patch release (7.3.7.3) published
  • 2026-07-02: advisory: CVE published to NVD

References