Krzysztof Surówka

**Name of the Vulnerable Software and Affected Versions** Apereo CAS Client version 4.1.0 Jasig CAS Client version 3.6.4 **Description** The software accepts any CA-trusted certificate for any hostname as long as the URL being called matches the configured allowlist or regex. A Man-in-the-Middle (MITM) attacker—utilizing methods such as DNS poisoning, rogue Wi-Fi, or a malicious proxy—can present any CA-signed certificate for a hostname that fits the allowlist or regex. This flaw allows the attacker to intercept the CAS exchange, capture the Ticket-Granting Ticket (TGT), and obtain Service Tickets on behalf of the victim. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.