Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN279
_____________________________________________________________________

DATE                : 10/03/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apereo CAS versions prior
                                 to 7.2.7.1, 7.3.5.

=====================================================================
https://apereo.github.io/2026/03/06/jwt-vuln/
_____________________________________________________________________

CAS JWT Authentication Vulnerability Disclosure
Friday, Mar 6, 2026
2 minute read
Overview

This is an Apereo CAS project vulnerability disclosure, describing an
issue in CAS while using a token-based JWT Authentication feature.

For additional details on how security issues, patches and
announcements are handled, please read the Apereo CAS project
vulnerability disclosure process.


Credits

This issue was originally reported, researched and tested by Mr. Jérôme
Leleu, who is a project member and an active committer. Jérôme was kind
enough to thoroughly investigate the issue, discuss the problem in
detail, provide steps to reproduce the problem and offer insight to
diagnose the root cause.

Thank you Jérôme!


Affected Deployments

The problem addressed here, per the CAS maintenance policy, affects the
Apereo CAS server for the following versions:

- 7.2.x
- 7.3.x

If your CAS version is not listed above AND is still part of an active
maintenance cycle per the CAS maintenance policy, then best effort
(analysis or confirmation from reporters/testers) indicates that the
version is not affected by this issue. That said, please note that per
the project’s Apache2 license, software distributed under the License
is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
ANY KIND, either express or implied. For additional information, please
see the project license.

If you or your institution is a member of the Apereo foundation with an
active support subscription supporting the CAS project, please contact
the CAS subs working group to learn more about this security
vulnerability report.


Severity

You are effected by this security vulnerability if your CAS deployment
has specifically enabled a feature called JWT Authentication, sometimes
also referred to as token-based non-interactive authN and accepts
credentials as JWTs for non-interactive authentication attempts. Note
that this has nothing to do with any other CAS functionality that deals
with JWTs. Additional details will be published soon once the security
grace period has passed.

If your deployment does not pass the noted condition(s) above, there is
nothing for you to do here. Keep calm and carry on.


Timeline

The issue was originally reported on March 2nd 2026, and upon
confirmation, CAS releases were patched and eventually published on
March 6th, 2026.


Patching

Patch releases are available to address CAS deployments. Upgrades to
the next patch version for each release should be a drop-in replacement.


Affected Versions
7.2.x

Modify your CAS overlay to point to the version 7.2.7.1.
7.3.x

Modify your CAS overlay to point to the version 7.3.5.
How to upgrade

    Locate your gradle.properties file in your CAS overlay, found at the
root of the project.
    Modify your CAS version to point to the approriate release by
updating the cas.version property.
    Follow the instructions in the README.md file to build the server.


Support

Apereo CAS is Apache v2 open source software under the sponsorship of the
Apereo Foundation. Support options may be found here.

If you or your institution is a member of the Apereo foundation with an
active CAS subscription supporting the CAS project, please contact the CAS
subs working group to learn more about this security vulnerability.


Resources

    CAS Security Vulnerability Response Model
    CAS Maintenance Policy
    CAS Mailing Lists

On behalf of the CAS Application Security working group,


Misagh Moayyed


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================