CVE-2026-15243: Apereo CAS Client Auth Bypass Vulnerability

CVE-2026-15243 Overview

CVE-2026-15243 is an improper certificate validation flaw [CWE-297] in the Apereo Central Authentication Service (CAS) client libraries. The client accepts any certificate authority (CA) trusted certificate for any hostname, provided the URL matches the configured allowlist or regular expression. This weakens Transport Layer Security (TLS) hostname verification and enables machine-in-the-middle (MITM) interception of CAS authentication exchanges. Confirmed affected releases include the Java Apereo CAS Client version 4.1.0 and the Jasig CAS Client version 3.6.4. Other versions may also be affected because upstream maintainer contact attempts were unsuccessful.

Critical Impact
An attacker in a network-adjacent position can intercept the CAS exchange, capture the Ticket-Granting Ticket (TGT), and obtain Service Tickets on behalf of the victim.

Affected Products

Java Apereo CAS Client 4.1.0
Jasig CAS Client 3.6.4
Other unverified versions of Apereo/Jasig CAS Client libraries may also be affected

Discovery Timeline

2026-07-24 - CVE-2026-15243 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15243

Vulnerability Analysis

The Apereo CAS client performs URL validation against an allowlist or regular expression before initiating outbound TLS calls to the CAS server. Once the URL passes that check, the client fails to enforce standard TLS hostname verification on the presented certificate. Any certificate signed by a trusted CA is accepted, regardless of the Subject Alternative Name (SAN) or Common Name (CN) values. This decouples the authorization check on the URL from the cryptographic identity check on the peer.

The result is a broken trust chain during authentication. An attacker who redirects traffic to a hostname matching the allowlist can present an unrelated CA-signed certificate and complete the TLS handshake. The CAS client will then transmit sensitive protocol material including the TGT and validate service tickets against the attacker-controlled endpoint.

Root Cause

The root cause is improper certificate validation [CWE-297]. The client library treats the allowlist or regex match as a sufficient trust decision and skips binding the certificate identity to the requested hostname. Hostname verification, which is normally required to defeat MITM under the Web PKI model, is effectively absent for URLs that pass the URL filter.

Attack Vector

Exploitation requires a network position capable of redirecting traffic, such as DNS poisoning, a rogue Wi-Fi access point, a malicious proxy, or a compromised upstream router. The attacker forces the victim's CAS client to connect to an attacker-controlled endpoint using a hostname that matches the client's allowlist. The attacker presents a certificate issued by any publicly trusted CA for any hostname. Because the client does not verify that the certificate matches the expected hostname, the TLS session succeeds. The attacker then relays or captures the CAS ticket exchange, extracts the TGT, and requests Service Tickets to impersonate the victim against downstream applications.

A verified proof-of-concept code sample is not published. Refer to the CERT PL CVE-2026-15243 analysis for exchange-level details.

Detection Methods for CVE-2026-15243

Indicators of Compromise

CAS client connections completing TLS handshakes with certificates whose SAN or CN does not match the requested CAS server hostname.
Unexpected DNS resolutions for CAS server hostnames pointing to IP addresses outside the organization's authoritative ranges.
CAS Ticket-Granting Ticket issuance followed by Service Ticket requests originating from unusual source IPs or user agents.

Detection Strategies

Inspect outbound TLS metadata from application servers running the Apereo or Jasig CAS client and alert when the presented certificate's SAN does not include the requested hostname.
Correlate DNS query responses for CAS endpoints against a known-good list of resolved IP addresses and flag deviations.
Monitor CAS server logs for TGT and Service Ticket issuance patterns that do not correspond to expected client subnets.

Monitoring Recommendations

Enable and centralize TLS handshake logging on hosts running CAS client integrations, including issuer, subject, and SAN fields.
Alert on any use of Java Apereo CAS Client 4.1.0 or Jasig CAS Client 3.6.4 in software bill of materials (SBOM) scans.
Track authentication anomalies such as concurrent sessions for a single principal from distinct geolocations following CAS logins.

How to Mitigate CVE-2026-15243

Immediate Actions Required

Inventory all applications embedding the Java Apereo CAS Client or Jasig CAS Client and record their exact versions.
Restrict CAS client network egress so that only known CAS server IP addresses are reachable, reducing the value of a hostname-matching allowlist bypass.
Enforce mutual TLS or certificate pinning between CAS clients and the CAS server where the deployment supports it.

Patch Information

At the time of publication, upstream maintainer contact attempts were reported as unsuccessful and no coordinated fix version has been listed in NVD. Consult the CERT PL CVE-2026-15243 analysis and the Apereo CAS project for updated remediation guidance and any subsequent releases.

Workarounds

Wrap CAS client HTTPS calls with a custom HostnameVerifier and TrustManager that explicitly validate the certificate SAN against the expected CAS server hostname.
Pin the CAS server certificate or its issuing intermediate CA within the client trust store instead of relying on the full public CA bundle.
Terminate CAS traffic through an internal reverse proxy that performs strict TLS validation and forwards only to the verified CAS endpoint.
Disable or remove any allowlist or regex configuration entries that permit hostnames outside the organization's controlled DNS zones.

bash

# Example: pin the CAS server certificate in a dedicated Java trust store
keytool -importcert \
  -alias cas-server \
  -file cas-server.crt \
  -keystore /etc/pki/cas-client-truststore.jks \
  -storepass changeit \
  -noprompt

# Point the CAS client JVM at the pinned trust store
export JAVA_OPTS="-Djavax.net.ssl.trustStore=/etc/pki/cas-client-truststore.jks \
  -Djavax.net.ssl.trustStoreType=JKS \
  -Djavax.net.ssl.trustStorePassword=changeit"