Apereo CAS Authentication Webflow State Vulnerability Advisory

CAS Vulnerability Disclosure Summary Vulnerability Overview Vulnerability Description: This vulnerability affects the Apereo CAS project, specifically concerning the state of CAS servers in managing authentication flows. Initial Disclosure: This is an initial disclosure for the Apereo CAS project; detailed information will be made public after the security embargo period ends. Handling Process: For more information on the handling of security issues, patches, and announcements, please refer to the Apereo CAS Project Vulnerability Disclosure Process. Impact Scope Affected Versions: According to the Apereo CAS maintenance policy, the following versions are affected: - 7.3.x Other Versions: If a CAS version is not listed but is still within its active maintenance cycle, it may not be impacted by this issue. Support Subscription: If you are an Apereo Foundation member with an active support subscription, please contact the CAS Support Working Group for more details. Exposure Conditions Exposure Conditions: The vulnerability affects deployments where CAS uses client browsers to manage the state of authentication webflows. This is the default setting and configuration for most deployments. Timeline and Acknowledgments Report Date: June 16, 2026 Patch Date: June 17, 2026 Reporter: Anonymous Patching and Upgrade Patch Release: The patched version was released on June 18, 2026. Upgrade Steps: 1. Locate the file. 2. Modify the property to point to the appropriate release version. 3. Build the server following the instructions in the file. Security in the AI Era Trends: AI is playing an increasingly important role in security research, documentation, explanation, and the submission of potential vulnerability reports. Challenges: With limited maintainer resources, automated verification and deployment have become particularly important. Support Open Source License: Apereo CAS is open-source software under the Apache v2 license, sponsored by the Apereo Foundation. Support Options: For more information, please see the Support Page. Resources Related Resources: - CAS Security Vulnerability Response Model - CAS Maintenance Policy - CAS Mailing List Related Posts Other Vulnerability Disclosures: - CAS Security Vulnerability Response Changes - CAS Vulnerability Disclosure - CAS OpenID Connect Vulnerability Disclosure - Java CAS Client JWT Vulnerability Disclosure - Apereo CAS - External Identity Providers - CAS JWT Authentication Vulnerability Disclosure - Service Registry Performance Improvements - Apereo CAS Dynamic Configuration Management - Apereo CAS Receives NLnet Funding - CAS OAuth/OpenID Connect Vulnerability Disclosure --- Note: POC code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Apereo CAS Authentication Webflow State Vulnerability Advisory