Product by Apereo
Apereo CAS
13 known vulnerabilities in Apereo CAS (Apereo), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Medium | CVE-2021-42567 | Apereo Central Authentication Service for WordPress: Cross-Site Scripting (XSS) | 6.1 | |
| Critical | CVE-2024-4399 | CAS <= 1.0.0 - Unauthenticated SSRF | 9.1 | |
| High | CVE-2019-10754 | Apereo CAS: security vulnerability | 8.1 | |
| Critical | CVE-2023-4612 | MFA bypass in Apereo CAS | 9.8 | |
| High | CVE-2020-27178 | Apereo Central Authentication Service for WordPress: security vulnerability | 7.5 | |
| High | CVE-2024-11208 | Apereo CAS login session expiration | 3.7 | |
| Not rated | CVE-2015-1169 | Apereo Central Authentication Service for WordPress: LDAP Injection | — | |
| Critical | CVE-2024-11209 | Apereo CAS 2FA login improper authentication | 6.3 | |
| High | CVE-2025-3986 | Apereo CAS CasConfigurationMetadataServerController.java redos | 4.3 | |
| Medium | CVE-2025-3985 | Apereo CAS ResponseEntity redos | 2.7 | |
| High | CVE-2025-3984 | Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection | 5.0 | |
| Medium | CVE-2024-11207 | Apereo CAS login redirect | 4.3 | |
| High | CVE-2023-28857 | LDAP password leak in Apereo CAS - GHSL-2023-009 | 4.0 |