CVE-2026-15243
CVE-2026-15243 is a high-severity vulnerability with a CVSS 4.0 base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-297.
Key facts
- Severity: High (CVSS 4.0 base score 7.4)
- EPSS exploit prediction: 0% (7th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-297
- Published:
- Last modified:
Description
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim. Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.
Frequently asked questions
- What is CVE-2026-15243?
- Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position (DNS poisoning, rogue Wi-Fi, malicious proxy, etc.) can provide any CA-signed certificate for a hostname that matches the configured allowlist or regex. This can lead to intercepting the CAS exchange, capturing the Ticket-Granting Ticket (TGT), and subsequently obtaining Service Tickets on behalf of the victim. Because maintainers contact attempts were unsuccessful, vulnerabilities have only been confirmed in version 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client) but may also affect other versions.
- How severe is CVE-2026-15243?
- CVE-2026-15243 has a CVSS 4.0 base score of 7.4, rated high severity.
- Is CVE-2026-15243 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-15243?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-15243 published?
- CVE-2026-15243 was published on 2026-07-24 and last updated on 2026-07-30.
References
Other CWE-297 vulnerabilities
- CVE-2025-46408 — Critical (CVSS 9.8): An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and…
- CVE-2026-59638 — Critical (CVSS 9.3): In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in.…
- CVE-2026-15925 — Critical (CVSS 9.2): Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have…
- CVE-2026-48144 — Critical (CVSS 9.1): Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue…
- CVE-2025-68637 — Critical (CVSS 9.1): The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default.…
- CVE-2026-35563 — High (CVSS 8.5): It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate…