{"id":"CVE-2023-4612","aliases":["EUVD-2023-54465","GHSA-fxgj-cfm7-w8hw"],"status":"published","title":"MFA bypass in Apereo CAS","description":"Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01115,"percentile":0.66284,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-302"],"published":"2023-11-09T13:41:38Z","modified":"2026-10-28T02:30:25Z","products":[{"vendor":"apereo","product":"cas"},{"vendor":"apereo","product":"central_authentication_service"},{"vendor":"apereo foundation","product":"cas"}],"references":[{"url":"https://cert.pl/posts/2023/11/CVE-2023-4612/","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert.pl/en/posts/2023/11/CVE-2023-4612/","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4612","tags":["advisory"]},{"url":"https://cert.pl/en/posts/2023/11/CVE-2023-4612"},{"url":"https://cert.pl/posts/2023/11/CVE-2023-4612"},{"url":"https://github.com/advisories/GHSA-fxgj-cfm7-w8hw"},{"url":"https://www.apereo.org/projects/cas","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4612.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4612","title":"MFA bypass in Apereo CAS","description":"Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.","status":"published","published":"2023-11-09T13:41:38.189Z","modified":"2025-02-26T21:25:31.425Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T14:35:30.851125Z"}],"euvd":[{"id":"EUVD-2023-54465","description":"Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.","status":"published","published":"2023-11-09T13:41:38Z","modified":"2025-02-26T21:25:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:22.427611Z"}],"ghsa":[{"id":"GHSA-fxgj-cfm7-w8hw","title":"Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest...","description":"Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.","status":"published","published":"2023-11-09T15:30:30Z","modified":"2025-02-27T00:30:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287","CWE-302"],"updated_at":"2026-11-02T15:00:03.81346Z"}],"nvd":[{"id":"CVE-2023-4612","description":"Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.","status":"published","published":"2023-11-09T14:15:08.183Z","modified":"2026-06-17T06:38:13.39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-302","CWE-287"],"updated_at":"2026-11-02T14:08:43.669554Z"}],"osv":[{"id":"CVE-2023-4612","title":"MFA bypass in Apereo CAS","description":"Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.","status":"published","published":"2023-11-09T13:41:38.189Z","modified":"2026-10-28T02:30:25.193335393Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-302"],"updated_at":"2026-11-02T15:44:34.287121Z"}]}}