Łukasz Kollbek

**Name of the Vulnerable Software and Affected Versions** Apereo CAS Client version 4.1.0 Jasig CAS Client version 3.6.4 **Description** The software accepts any CA-trusted certificate for any hostname as long as the URL being called matches the configured allowlist or regex. A Man-in-the-Middle (MITM) attacker—utilizing methods such as DNS poisoning, rogue Wi-Fi, or a malicious proxy—can present any CA-signed certificate for a hostname that fits the allowlist or regex. This flaw allows the attacker to intercept the CAS exchange, capture the Ticket-Granting Ticket (TGT), and obtain Service Tickets on behalf of the victim. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Directory LDAP API version 2.1.7 **Description** The LDAP client implementation fails to verify if the server certificate matches the intended LDAP hostname. Although the certificate chain is validated against a trusted authority, the lack of endpoint identification allows a valid certificate issued for an unrelated host to be accepted. This flaw enables server impersonation and complete connection compromise if an attacker with Man-in-the-Middle (MITM) capabilities presents a certificate trusted by the client's trust store. **Recommendations** Update to the new version of the LDAP API where hostname verification is enforced.