CVE-2026-15243

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243

The CVE-2026-15243 issue affects the Apereo CAS Client where the client accepts any CA-trusted certificate for a hostname that matches the configured allowlist or regex. The underlying risk is a MITM attacker could present a any CA-signed certificate for a permitted hostname, enabling interceptio...

EUVD-2026-48560

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243 Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

CVE-2026-15243 Improper Validation of Certificate in CAS Client

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

PT-2026-64277

Name of the Vulnerable Software and Affected Versions Apereo CAS Client version 4.1.0 Jasig CAS Client version 3.6.4 Description The software accepts any CA-trusted certificate for any hostname as long as the URL being called matches the configured allowlist or regex. A Man-in-the-Middle MITM...

CVE-2026-15243: Improper Validation of Certificate with Host Mismatch

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

com.keyholesoftware:khs-sherpa-spring (>=1.2.0, <=1.2.1), org.codehaus.spring-security-oauth:spring-security-oauth (>=3.9.ss3, <=3.11.ss3) +9 more potentially affected by CVE-2026-47838 via org.springframework.security:spring-security-web (3.0.0.release)

org.springframework.security:spring-security-web MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.keyholesoftware:khs-sherpa-spring =1.2.0, =3.9.ss3,...

com.force.sdk:force-springsecurity (>=22.0.2-beta, <=22.0.9-beta), com.logitags:cibet (>=1.1, <=1.9) +17 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.0.3.release)

org.springframework.security:spring-security-web MAVEN version 3.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.force.sdk:force-springsecurity =22.0.2-beta, =1.1,...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

org.jasig.cas:cas-client (3.0-rc1) potentially affected by CVE-2026-41848 via org.springframework:spring-core (2.0-rc2)

org.springframework:spring-core MAVEN version 2.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-core and may be impacted: - org.jasig.cas:cas-client 3.0-rc1 Source cves: CVE-2026-41848 Source advisory:...

com.ovea.tajin.server:tajin-server-jetty8 (>=1.0.b1, <=1.0.b11), com.ovea.tajin.server:tajin-server-jetty9 (>=1.0.b1, <=1.0.b11) +10 more potentially affected by CVE-2026-42498 via org.apache.tomcat:tomcat-catalina (7.0.8)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.ovea.tajin.server:tajin-server-jetty8 =1.0.b1, =1.0.b1, =4.7.1, =3.2.1, =1.2.0.beta1,...

com.ovea.tajin.server:tajin-server-jetty8 (>=1.0.b1, <=1.0.b11), com.ovea.tajin.server:tajin-server-jetty9 (>=1.0.b1, <=1.0.b11) +10 more potentially affected by CVE-2026-43513 via org.apache.tomcat:tomcat-catalina (7.0.8)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.ovea.tajin.server:tajin-server-jetty8 =1.0.b1, =1.0.b1, =4.7.1, =3.2.1, =1.2.0.beta1,...

com.amazonaws:aws-dynamodb-session-tomcat (2.0.4), org.apache.tomcat:tomcat-catalina-ha (8.0.1) +3 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (8.0.1)

org.apache.tomcat:tomcat-catalina MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.amazonaws:aws-dynamodb-session-tomcat 2.0.4 - org.apache.tomcat:tomcat-catalina-ha 8.0.1 ...

com.aceql:aceql-http (>=6.1, <=6.2), org.apache.cxf.systests:cxf-systests-cdi-base (3.3.8) +11 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.59)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.59 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.aceql:aceql-http =6.1, =6.2 -...

com.ovea.tajin.server:tajin-server-jetty8 (>=1.0.b1, <=1.0.b11), com.ovea.tajin.server:tajin-server-jetty9 (>=1.0.b1, <=1.0.b11) +10 more potentially affected by CVE-2026-43515 via org.apache.tomcat:tomcat-catalina (7.0.8)

org.apache.tomcat:tomcat-catalina MAVEN version 7.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-catalina and may be impacted: - com.ovea.tajin.server:tajin-server-jetty8 =1.0.b1, =1.0.b1, =4.7.1, =3.2.1, =1.2.0.beta1,...

com.payneteasy.superfly:superfly-web (>=1.2-1, <=1.4-3), org.codehaus.enunciate:enunciate-spring3-security-rt (>=1.20, <=1.22) +10 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.0.2.release)

org.springframework.security:spring-security-web MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.payneteasy.superfly:superfly-web =1.2-1, =1.20,...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...

com.spatineo:geoserver-tomcat8-valve (1.0), org.apache.tomcat:tomcat-catalina (8.5.46) +11 more potentially affected by CVE-2026-24733 via org.apache.tomcat:tomcat-coyote (8.5.46)

org.apache.tomcat:tomcat-coyote MAVEN version 8.5.46 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote and may be impacted: - com.spatineo:geoserver-tomcat8-valve 1.0 - org.apache.tomcat:tomcat-catalina 8.5.46 -...