CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim. Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/07/CVE-2026-15243
https://www.apereo.org/programs/software/cas

Configurations

No configuration.

History

24 Jul 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-24 12:16

Updated : 2026-07-30 19:09

NVD link : CVE-2026-15243

Mitre link : CVE-2026-15243

CVE.ORG link : CVE-2026-15243

JSON object : View

Products Affected

No product.

CWE

CWE-297

Improper Validation of Certificate with Host Mismatch

{"id": "CVE-2026-15243", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15243", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T12:33:47.532505Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"repo": "https://github.com/apereo/java-cas-client", "vendor": "Apereo", "product": "Java Apereo CAS Client", "versions": [{"status": "affected", "version": "4.1.0", "versionType": "semver"}], "defaultStatus": "unknown"}, {"repo": "https://github.com/apereo/java-cas-client", "vendor": "Apereo", "product": "Jasig CAS Client", "versions": [{"status": "affected", "version": "3.6.4"}], "packageName": "org.jasig.cas.client", "collectionURL": "https://mvnrepository.com/", "defaultStatus": "unknown"}]}], "published": "2026-07-24T12:16:46.973", "references": [{"url": "https://cert.pl/en/posts/2026/07/CVE-2026-15243", "source": "cvd@cert.pl"}, {"url": "https://www.apereo.org/programs/software/cas", "source": "cvd@cert.pl"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-297"}]}], "descriptions": [{"lang": "en", "value": "Apereo CAS Client\u00a0accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to\u00a0intercepting the CAS exchange, capturing the\u00a0Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.\u00a0\n\n\nBecause maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and\u00a03.6.4 (Jasig CAS Client) but may also affect other versions."}], "lastModified": "2026-07-30T19:09:13.930", "sourceIdentifier": "cvd@cert.pl"}