The vulnerability arises from the Apereo CAS Client accepting any CA‑trusted certificate for any hostname that matches an allowlist or regex, without verifying the hostname in the certificate. Because the client does not enforce hostname validation, an attacker positioned as a man‑in‑the‑middle can supply a legitimate CA‑signed certificate for a target hostname. The attacker can then intercept the CAS authentication flow, capture the Ticket‑Granting Ticket, and use it to obtain Service Tickets on behalf of the victim. This effectively allows credential hijacking and impersonation, as the attacker can access protected services with the victim’s privileges. The weakness is a classic example of CWE‑297, Improper Certificate Validation.

The issue has been confirmed in two Apereo CAS Client releases: Java Apereo CAS Client version 4.1.0 and Jasig CAS Client version 3.6.4. The problem may also exist in other, older versions of these products, but no specific version list is available beyond the confirmed releases.

The CVSS score of 7.4 indicates high severity. The EPSS score is less than 1 %, suggesting that, as of the current data, the likelihood of exploitation is low, but the potential impact remains high. The vulnerability is not listed in CISA’s KEV catalog, so no widespread exploitation has been reported yet. Attackers can exploit this flaw only when positioned in a network that can perform DNS poisoning, rogue Wi‑Fi, or a malicious proxy, and the CAS client’s target URL must match the allowlist or regex. The CVE description does not specify whether an attacker requires authentication or privileged access to exploit the flaw.