A vulnerability in the Apereo CAS Client allows for potential man-in-the-middle attacks by failing to properly enforce hostname verification for trusted certificates.

This is an improper validation of certificate with host mismatch (CWE-297). The vulnerability permits an unauthenticated attacker to impersonate a legitimate service by providing a CA-trusted certificate, bypassing standard hostname checks.

Successful exploitation allows an attacker to intercept or manipulate sensitive authentication traffic, potentially leading to unauthorized access to enterprise systems. With a CVSS score of 7.4, this high-severity flaw poses a significant risk to identity and access management infrastructure, where integrity and confidentiality are paramount.

Immediate Action: Upgrade to the latest version of the Apereo CAS Client as provided by the vendor to ensure proper hostname validation logic is implemented.

Proactive Monitoring: Review application access logs for unusual connection patterns or unexpected certificate validation failures.

Compensating Controls: Ensure strict network segmentation and utilize mutual TLS (mTLS) where possible to reduce the reliance on standard certificate validation alone.

Public Exploit Available: Unknown.

Given the potential for credential interception, organizations using the affected versions of the Apereo CAS Client must prioritize applying the vendor-supplied patches. Verification of the patch deployment should be conducted immediately to neutralize the risk of man-in-the-middle attacks.