Skip to contentApereo Cas vulnerabilities
- apereo jasig cas client, java apereo cas client +1 moreImproper Validation of Certificate in CAS ClientCVE-2026-152437.4 High
- apereo casApereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information DisclosureCVE-2026-590999.3 Critical
- apereo opencastOpencast's editor accidentally publishes videos/overwrites publications #1626CVE-2025-619062.3 Low
- apereo opencastOpencast Paella Player 7 vulnerable to Cross-Site-ScriptingCVE-2025-617885.1 Medium
- apereo opencastOpencast has a partial path traversal vulnerability in UI configCVE-2025-55202Fix available2.7 Low
- apereo opencastOpencast still publishes global system account credentialsCVE-2025-54380Fix available6.5 Medium
- apereo cas, central authentication service +1 moreApereo CAS CasConfigurationMetadataServerController.java redosCVE-2025-39865.3 Medium
- apereo cas, central authentication service +1 moreApereo CAS ResponseEntity redosCVE-2025-39855.1 Medium
- apereo cas, central authentication service +1 moreApereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injectionCVE-2025-39842.3 Low
- apereo opencastSearching Opencast may cause a denial of serviceCVE-2024-52797Fix available6.5 Medium
- apereo cas, cas server, central authentication service +2 moreApereo CAS 2FA login improper authenticationCVE-2024-112095.3 Medium
- apereo cas, cas server, central authentication service +2 moreApereo CAS login session expirationCVE-2024-112086.3 Medium
- apereo cas, central authentication service +1 moreApereo CAS login redirectCVE-2024-112075.3 Medium
- apereo cas, central authentication service +1 moreCAS <= 1.0.0 - Unauthenticated SSRFCVE-2024-43999.1 Critical
- apereo casCAS <= 1.0.0 - Unauthenticated Arbitrary File AccessCVE-2024-43887.5 High
- apereo cas, central authentication service +1 moreMFA bypass in Apereo CASCVE-2023-46129.8 Critical
- apereo cas, central authentication service +1 moreLDAP password leak in Apereo CAS - GHSL-2023-009CVE-2023-28857Fix available4.0 Medium
- apereo opencastOpencast Authenticated OpenRedirect VulnerabilityCVE-2022-41965Fix available5.7 Medium
- apereo phpcas, fedoraproject fedora +1 moreService Hostname Discovery Exploitation in phpCASCVE-2022-39369Fix available8.0 High
- apereo opencastLimited Authentication Bypass for Media Files in OpencastCVE-2022-29237Fix available5.4 Medium
- apereo opencastOpencast publishes global system account credentialsCVE-2018-16153Fix available7.5 High
- apereo opencastFiles Accessible to External Parties in OpencastCVE-2021-43821Public exploitFix available9.9 Critical
- apereo opencastHTTP Method Spoofing in OpencastCVE-2021-43807Fix available7.5 High
- apereo opencastOpencast vulnerable to billion laughs attack (XML bomb)CVE-2021-32623Fix available8.1 High
- apereo opencastRemoving access may not effect published seriesCVE-2021-213185.4 Medium
- apereo opencastDisabled Hostname Verification in OpenCastCVE-2020-26234Fix available4.8 Medium
- apereo opencastAuthentication Bypass For Endpoints With Anonymous Access in OpenCastCVE-2020-5206Fix available8.7 High
- apereo opencastOpencast users with ROLE_COURSE_ADMIN can create new usersCVE-2020-5231Fix available4.8 Medium
- apereo opencastOpencast uses unsafe identifiersCVE-2020-5230Fix available7.7 High
- apereo opencastHard-Coded Key Used For Remember-me Token in OpenCastCVE-2020-5222Fix available6.8 Medium
- apereo opencastOpencast stores passwords using outdated MD5 hash algorithmCVE-2020-5229Fix available7.7 High
- apereo opencastOpencast allows unauthorized public access via OAI-PMHCVE-2020-5228Fix available7.6 High
- jasig project php-pear-cas, apereo phpcas, debian linux +1 more +3 moreAn Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in...CVE-2012-11055.5 Medium
- apereo phpcas, debian linux +1 moreA Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to...CVE-2012-11045.3 Medium
- apereo cas serverXML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS...CVE-2014-22968.8 High
- apereo opencastOpencast has Incorrect Permission AssignmentCVE-2017-1000221Fix available6.5 Medium
- apereo phpcasJasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20...CVE-2017-1000071Fix available8.1 High
- apereo .net cas client, java cas client, phpcas +2 more +4 moreJasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerabilityCVE-2014-4172Fix available9.8 Critical
- apereo phpcasphpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject...CVE-2012-5583Fix available5.8 Medium
- apereo phpcasDirectory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3,...CVE-2010-36926.4 Medium
- apereo phpcasPGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to...CVE-2010-36913.3 Low
- apereo phpcasMultiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is...CVE-2010-36904.3 Medium