Apereo Foundation vulnerabilities
2 vulnerabilities
Known vulnerabilities in Apereo Foundation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- CAS1 vulnerabilities
- Openequella1 vulnerabilities
CVE-2026-67615apereo foundationopenequella
EPSS score0.54%
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass the class-name denylist enforced by PluginAwareObjectInputStream by nesting a serialized payload inside a java.security.SignedObject, causing the inner stream to be deserialized by a separate ObjectInputStream that does not apply the denylist, ultimately reaching a JNDI sink and enabling code execution.CVE-2023-4612apereo foundationcas+1EPSS score0.94%
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.