CVE-2026-15243: Improper Validation of Certificate in CAS Client
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim.
Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apereo CAS Clientto a version that resolves this vulnerability.Fixed in 4.1.0 - Upgrade
Upgrade
Jasig CAS Clientto a version that resolves this vulnerability.Fixed in 3.6.4 - Compensating control
Use a network-level control to prevent/manipulation of client connections that enable MITM (e.g., mitigate DNS poisoning, rogue Wi-Fi, and malicious proxies) so attackers cannot intercept the CAS exchange.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15243?
CVE-2026-15243 has a severity rating of high, with a CVSS score of 7.4.
How do I fix CVE-2026-15243?
To address CVE-2026-15243, ensure that the Apereo CAS Client is updated to the latest version that includes fixes for certificate validation.
What systems are affected by CVE-2026-15243?
CVE-2026-15243 affects Apereo CAS Client and Jasig CAS Client.
What type of attack can exploit CVE-2026-15243?
CVE-2026-15243 can be exploited through a Man-in-the-Middle (MITM) attack, such as DNS poisoning or using a malicious proxy.
What is the main issue with CVE-2026-15243?
The main issue with CVE-2026-15243 is improper validation of certificates, allowing attackers to potentially use fraudulent CA-signed certificates.