CVE-2026-15243

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15243

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15243.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15243

Published

2026-07-24T11:29:26.067Z

Modified

2026-07-27T04:02:24.476974320Z

Severity

7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Improper Validation of Certificate in CAS Client

Details

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.

Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15243.json",
    "cna_assigner": "CERT-PL",
    "cwe_ids": [
        "CWE-297"
    ]
}

References

Affected packages

Git / github.com/apereo/java-cas-client

Affected ranges

Type

GIT

Repo

https://github.com/apereo/java-cas-client

Events

Introduced

79c56c462fd2b5d2d4666044e8b6095803efb161

Last affected

16ed1eeef926ad892e6c570e2eba9847375796da

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "last_affected": "4.1.0"
        },
        {
            "introduced": "3.6.4"
        },
        {
            "last_affected": "3.6.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

3.*

3.6.4

4.*

4.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15243.json"