Loading story…
CERT Polska disclosed CVE-2026-15243, an improper certificate validation vulnerability affecting Apereo CAS Client software. The issue can undermine trust checks during certificate handling, creating a risk that affected deployments could accept invalid or untrusted certificates and expose authentication-related communications to interception or impersonation scenarios.
Public reporting on the flaw identified Apereo CAS Client as the impacted product and linked the disclosure to CERT Polska's advisory. Organizations using the client software should review the vendor and CERT guidance for affected versions, assess where the component is deployed in single sign-on environments, and prioritize remediation or compensating controls to reduce the risk of certificate-based trust bypass.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska published a notice about CVE-2026-15243, an improper certificate validation vulnerability affecting Apereo CAS Client software.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw tracked as **`CVE-2026-59099`** was disclosed in **Apereo CAS**, the open-source single sign-on platform, affecting versions **7.3.0 through 8.0.0-RC5**. The bug stems from **AES-GCM nonce reuse** caused by a fixed all-zero IV being used with the same encryption key for the life of the server, allowing an unauthenticated remote attacker to collect client-side webflow execution tokens from the login page and use known-plaintext techniques to decrypt webflow conversation state. The issue can expose sensitive session, identity, and application data, and was rated **critical** with **CVSS 4.0 9.3** and **CVSS 3.1 9.1**. The disclosure highlights how cryptographic implementation mistakes can turn protected traffic or tokens into recoverable plaintext, echoing earlier SSL/TLS weaknesses such as attacks against **RC4** that similarly enabled partial plaintext recovery from encrypted sessions. Apereo was notified on June 16, fixed the issue on June 17, and released patched versions on June 18; affected organizations were urged to upgrade to **`8.0.0-RC6`** or the relevant patch release and to rotate signing and encryption keys if they had operated vulnerable deployments.
Jul 12, 2026
CERT/CC and independent researchers disclosed multiple critical vulnerabilities in the open-source identity and access management platform **Casdoor**, affecting version `2.362.0` and earlier. The most severe issue, **`CVE-2026-9090`**, stems from improper SAML certificate validation that can let an attacker forge assertions using a self-controlled certificate and log in without valid credentials. Additional flaws, including **`CVE-2026-9091`**, can allow multi-factor authentication bypass and exploitation of weak account-binding logic, while **`CVE-2026-9094`** and **`CVE-2026-9097`** create risks of cross-organization token abuse and privilege escalation. The disclosures warn that the vulnerabilities undermine core authentication and access-management controls in deployments using Casdoor for identity federation and tenant separation. Researchers said no official patch was available at disclosure because they were unable to coordinate with the Casdoor team, and advised defenders to apply manual mitigations such as restricting identity provider integrations, tightening identity governance, enforcing downstream MFA protections, and monitoring for anomalous SAML responses and token-exchange activity.
Jun 29, 2026
Cisco disclosed a critical certificate validation vulnerability in cloud-based **Webex Services** that could let an unauthenticated remote attacker bypass authentication and impersonate legitimate users in environments using single sign-on through **Webex Control Hub**. The flaw, tracked as `CVE-2026-20184` and rated **CVSS 9.8**, stems from improper certificate validation in the SSO implementation (`CWE-295`), which could cause malicious authentication tokens to be accepted as valid. Cisco said it patched the backend cloud service, but affected organizations must also manually upload a new **SAML certificate** for their Identity Provider in Webex Control Hub to fully remediate the issue. The company said there are **no workarounds**, warned that customers who do not update their SAML certificates may remain exposed and could face service disruption, and added that the vulnerability was found during internal security testing with **no known public exploitation** reported at disclosure.
Jun 29, 2026