7.4

CVE-2026-15243: apereo jasig cas client

CVSS: 7.4v4.0HighAwaiting analysis
Published 24-07-2026Last modified 24-07-2026
Open JSON

Vulnerability summary

CVE-2026-15243 is a high (CVSS 7.4) vulnerability in apereo jasig cas client. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.6% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v4.0 (CVE.org)
EPSS score
0.26%
0%100%
Low · +0.09 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 24-07-2026
    PublishedVulnerability first disclosed.
  2. 24-07-2026
    Last modifiedVulnerability information updated.

Description

Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim. Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.26%

Chance of exploitation in the next 30 days

Percentile

17%

Versus all other CVEs

30-day change

+0.09 pp

From 0.17% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.26%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apereo2 products

1 vendor · 2 products

References

2 links