CA
Product
Central Authentication Service
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 3Low 0
Watch
Add Central Authentication Service to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-11209 | 9.8 | Nov 14 | Apereo CAS 2FA login improper authentication Affected: 6.6.0 |
| CVE-2023-4612 | 9.8 | Nov 9 | MFA bypass in Apereo CAS Affected: before 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +2 more |
| CVE-2024-4399 | 9.1 | May 23 | CAS <= 1.0.0 - Unauthenticated SSRF Affected: All versions, or not specified |
| CVE-2024-11208 | 8.1 | Nov 14 | Apereo CAS login session expiration Affected: 6.6.0 |
| CVE-2019-10754 | 8.1 | Sep 23 | Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due… Affected: through 6.0.5.1; 6.1.0; 6.1.0; 6.1.0; 6.1.0 |
| CVE-2025-3986 | 7.5 | Apr 27 | Apereo CAS CasConfigurationMetadataServerController.java redos Affected: 5.2.6 |
| CVE-2025-3984 | 7.5 | Apr 27 | Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection Affected: 5.2.6 |
| CVE-2023-28857 | 7.5 | Jun 27 | LDAP password leak in Apereo CAS - GHSL-2023-009 Affected: 6.5.0 before 6.5.9.1; 6.6.0 before 6.6.6 |
| CVE-2020-27178 | 7.5 | Oct 16 | Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication Affected: 5.3.0 before 5.3.16; 6.0.0 before 6.1.7.2; 6.2.0 before 6.2.4; 6.3.0; 6.3.0; 6.3.0 |
| CVE-2021-42567 | 6.1 | Dec 7 | Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints Affected: 6.3.0 before 6.3.7.1; 6.4.0 before 6.4.2 |
| CVE-2024-11207 | 5.4 | Nov 14 | Apereo CAS login redirect Affected: 6.6.0 |
| CVE-2025-3985 | 4.9 | Apr 27 | Apereo CAS ResponseEntity redos Affected: 5.2.6 |
| CVE-2015-1169 | – | Feb 10 | Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a… Affected: through 3.5.2 |
Showing 13