Advisories for Maven/Org.apereo.cas/Cas-Server-Core-Services-Authentication package

Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL …

Apereo CAS allows XSS via POST requests sent to the REST API endpoints.

Apereo CAS mishandles secret keys with Google Authenticator for multifactor authentication.

Multiple classes used within Apereo CAS make use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.