Which versions of Apereo CAS are affected by EUVD-2026-41430?

Apereo CAS (versions 7.3.0 through 8.0.0-RC5) contains a critical authentication vulnerability allowing remote unauthenticated attackers to decrypt login session tokens through cryptographic nonce…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-41430?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41430. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-41430?

Within 24 hours: Identify all systems running Apereo CAS versions 7.3.0 through 8.0.0-RC5 and assess internet exposure. Within 7 days: Apply vendor patch to upgrade to version 8.0.0-RC6 or later. Within 30 days: Verify patch deployment on all instances, audit authentication logs for exploitation attempts, and reset user credentials for potentially compromised accounts.

Apereo CAS EUVD-2026-41430

Q: What is the CVSS score of EUVD-2026-41430?

EUVD-2026-41430 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-59099 CRITICAL

Reusing a Nonce, Key Pair in Encryption (CWE-323)

2026-07-02 VulnCheck

GHSA-phqw-pwxm-86gq

Information Disclosure Cas

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Login page is remotely reachable and unauthenticated (AV:N/PR:N/UI:N); token collection and known-plaintext analysis are straightforward (AC:L); GCM nonce reuse breaks both confidentiality and authentication (C:H/I:H), with no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 20:34 vuln.today

CVSS changed

Jul 02, 2026 - 20:22 NVD

9.1 (CRITICAL) 9.3 (CRITICAL)

DescriptionCVE.org

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow conversation state due to keystream reuse caused by a fixed all-zero IV paired with the same encryption key.

AnalysisAI

Plaintext recovery of webflow conversation state in Apereo CAS (versions 7.3.0 up to but not including 8.0.0-RC6) lets remote unauthenticated attackers decrypt sensitive login-flow data by exploiting AES-GCM nonce reuse. Because the server encrypts client-side webflow execution tokens with a fixed all-zero initialization vector under a single long-lived key, an attacker can harvest multiple tokens from the public login page and apply known-plaintext/keystream-reuse analysis to break confidentiality (and, given GCM's nonce-reuse properties, integrity of the token). Publicly available exploit code exists; the flaw was reported by VulnCheck and carries a CVSS 4.0 base of 9.3, though no CISA KEV listing or EPSS score is provided.

Technical ContextAI

Apereo CAS is a widely used open-source enterprise single sign-on / central authentication service. The affected component is its Spring Webflow-based login flow, which serializes and encrypts 'conversation state' into client-held execution tokens using AES in Galois/Counter Mode (GCM). AES-GCM is a stream-cipher-like AEAD construction whose security absolutely depends on a unique nonce (IV) per encryption under a given key; CAS instead paired a hard-coded all-zero IV with a single server-lifetime key, so every token is encrypted with an identical keystream. This is the exact failure class described by CWE-323 (Reusing a Nonce/Key Pair in Encryption): XORing two ciphertexts produced under the same keystream cancels the keystream and reveals the XOR of the two plaintexts, enabling known-plaintext recovery. Nonce reuse in GCM is especially severe because it also permits recovery of the GHASH authentication subkey, undermining the integrity/authentication guarantee of the tag, not just confidentiality.

RemediationAI

Vendor-released patch: 8.0.0-RC6 - upgrade Apereo CAS to 8.0.0-RC6 or later, which is available at https://github.com/apereo/cas/releases/tag/v8.0.0-RC6 with the underlying fix in commit https://github.com/apereo/cas/commit/22c6f4adf738852782309b523b4e80371057f2d0 (see the advisory at https://apereo.github.io/2026/06/18/vuln/). The core fix replaces the fixed all-zero IV with a properly randomized per-encryption nonce, so patching is the definitive remedy. If immediate upgrade is not possible, compensating controls include switching webflow session storage away from the vulnerable client-side encrypted mode to server-side storage (e.g., server session or a distributed store) so conversation state is no longer serialized into attacker-collectible tokens - trade-off: this adds server-side session state and may require sticky sessions or a shared cache in clustered deployments. Rotating the webflow encryption/signing keys does not fix the underlying IV-reuse flaw and should not be relied upon as a mitigation. Restricting exposure of the login page (e.g., placing it behind a WAF/reverse proxy that rate-limits token collection) only raises the effort to gather sufficient ciphertexts and is not a true fix.