Vulnerability in Apereo Jasig Cas Client
CVE-2026-15243
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) c…
Affected products
- Apereo Jasig Cas Client — versions 3.6.4
- Apereo Java Cas Client — versions 4.1.0
Weakness classification (CWE)
References
- cvd@cert.pl (third-party-advisory)
- cvd@cert.pl (product)