CVE-2026-15243 describes a vulnerability in the Apereo Java Apereo CAS Client where the client accepts any certificate signed by a trusted CA regardless of hostname mismatch, provided the URL matches a configured allowlist or regex. This improper validation (CWE-297) enables attackers with a MITM position to present a valid CA-signed certificate for a hostname in the allowlist, intercept the CAS authentication exchange, capture the Ticket-Granting Ticket (TGT), and obtain Service Tickets on behalf of the victim. The vulnerability has been confirmed in versions 4.1.0 (Java Apereo CAS Client) and 3.6.4 (Jasig CAS Client), with potential impact on other versions. Attempts to contact maintainers were unsuccessful, and no remediation level or patch is currently documented.

An attacker capable of man-in-the-middle attacks (e.g., via DNS poisoning, rogue Wi-Fi, or malicious proxy) can exploit this vulnerability to intercept authentication tokens (TGT and Service Tickets) from the CAS client. This compromises the authentication process, allowing unauthorized access to services on behalf of the victim. The CVSS 4.0 score of 7.4 (high severity) reflects the network attack vector, low attack complexity, partial attack traceability, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating man-in-the-middle risks by restricting network access, using additional transport security measures, or avoiding use of affected versions 4.1.0 and 3.6.4 where possible. Monitor vendor channels for updates and patches.