A critical code injection vulnerability (CVE-2025-3984) exists in Apereo CAS version 5.2.6 and earlier in the saveService function of the cas-management-webapp-support component. This vulnerability involves the Groovy Code Handler and allows remote code injection. Exploitation is considered difficult due to high attack complexity. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.