Apereo CAS contains a critical cryptographic vulnerability that allows unauthenticated attackers to recover plaintext conversation state, leading to potential identity and session compromise.

The application utilizes a fixed all-zero initialization vector (IV) with AES-GCM encryption, resulting in keystream reuse. This allows unauthenticated remote attackers to perform known-plaintext analysis on collected webflow execution tokens.

The ability to decrypt conversation states poses a severe threat to authentication security, potentially exposing sensitive session information or facilitating session hijacking. With a CVSS score of 9.1, this represents a critical risk to any enterprise relying on Apereo CAS for centralized authentication and identity management.

Immediate Action: Upgrade to version 8.0.0-RC6 or later to implement secure, unique initialization vector generation for all cryptographic operations.

Proactive Monitoring: Monitor authentication logs and webflow traffic for patterns indicative of automated token collection or high-frequency requests from single sources.

Compensating Controls: While no direct WAF rule can fix the underlying cryptographic flaw, rate-limiting login attempts can slow down the token collection process required for this attack.

Public Exploit Available: Unknown

This vulnerability undermines the fundamental security of the CAS identity provider. Organizations must treat this as a high-priority update to prevent the exposure of plaintext session data. Patching is the only effective way to resolve the underlying keystream reuse issue.