Skip to content
OpenAdvisories

Vendor

Apereo

18 known vulnerabilities.

Products

cas 9 openEQUELLA 7 Java Apereo CAS Client 1 Jasig CAS Client 1 phpCAS 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-66088

    Unrestricted Command Execution via system.execute

    In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arb…

    Apereo openEQUELLA
  • Critical 9.1
    CVE-2026-59099

    Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure

    Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect m…

    Apereo cas
  • Critical 9.8
    CVE-2023-4612

    MFA bypass in Apereo CAS

    Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fi…

    Apereo cas