org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-RC1 <=8.0.0-RC4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-RC1 <=8.0.0-RC4) +3 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-M1 <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-M1, =8.0.0-RC1, =8.0.0-RC1, =5.0.0, =5.0.0, =5.0.1 Source cves: CVE-2026-40982 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-16439043...

org.apereo.cas:cas-server-support-shell (=5.2.0-RC2), org.apereo.cas:cas-server-webapp (>=5.2.0 <=5.2.6) +3 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (>=5.2.0-RC2 <=5.2.6)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version =5.2.0-RC2, =5.2.0, =5.2.0, =5.2.0, =5.2.0, =5.2.6 Source cves: CVE-2025-3986 Source advisory: OSV:GHSA-MVWQ-HCRJ-F5X9...

org.apereo.cas:cas-server-webapp (=6.0.0-RC4), org.apereo.cas:cas-server-webapp-jetty (=6.0.0-RC4) +2 more potentially affected by CVE-2025-3986 via org.apereo.cas:cas-server-core-configuration-metadata-repository (=6.0.0-RC4)

org.apereo.cas:cas-server-core-configuration-metadata-repository MAVEN version =6.0.0-RC4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-configuration-metadata-repository and may be impacted: -...

org.jasig.cas:cas-management-webapp (>=4.0.0 <=4.0.7), org.jasig.cas:cas-server-webapp (>=3.5.1 <=3.6.0) potentially affected by CVE-2023-34613 via net.sf.sojo:sojo (=1.0.5)

net.sf.sojo:sojo MAVEN version =1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.sojo:sojo and may be impacted: - org.jasig.cas:cas-management-webapp =4.0.0, =3.5.1, =3.6.0 Source cves: CVE-2023-34613 Source advisory: OSV:GHSA-75R3-38RH-PMX...

Cross-site Scripting (XSS)

cas-server-webapp is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the security questions in casResetPasswordVerifyQuestionsView.html can contain html tags and have lack of sanitization, allowing XSS attacks...