Apereo CAS Client MITM cert flaw disclosed
Apereo/Jasig CAS Client accepts any CA-trusted certificate for allowlisted hostnames, letting a MITM attacker steal CAS tickets and impersonate users.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-15243, a certificate-validation flaw in the Apereo CAS Client (and its predecessor Jasig CAS Client) used to implement Single Sign-On authentication. The client validates only that a presented TLS certificate is signed by a trusted CA and that the requested URL matches a configured allowlist or regex, without verifying that the certificate actually belongs to the expected hostname. An attacker positioned to intercept traffic — via DNS poisoning, a rogue Wi-Fi access point, or a malicious proxy — can present any valid CA-signed certificate for an allowlisted-matching hostname to intercept the CAS authentication exchange.
Successful exploitation allows the attacker to capture a victim's Ticket-Granting Ticket (TGT) and subsequently mint Service Tickets on the victim's behalf, effectively hijacking SSO sessions across services relying on the compromised CAS instance. The issue has been confirmed in Java Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4, though other versions may be affected. CERT Polska notes that attempts to contact the maintainers were unsuccessful, so no official patch is currently confirmed, leaving organizations reliant on unpatched or unmaintained CAS client implementations exposed until remediation or mitigating controls (such as enforced hostname verification or network-layer TLS protections) are applied.
Mentioned in this report
Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-15243
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs