The Apereo CAS project has approved a proposal to shorten our security grace window from four weeks to two weeks. Going forward, security fixes will follow a two-week grace period before broader public disclosure and announcement. This chan…
This is an initial Apereo CAS project vulnerability disclosure, which describes a security vulnerability that affects how the CAS server manages state for authentication flows. Additional details will be made public once the security grace
This is an initial Apereo CAS project vulnerability disclosure, which describes a series of security vulnerabilities that affect different features and aspects of the CAS server. Additional details will be made public once the security grac…
This is an initial Apereo CAS project vulnerability disclosure, describing an issue in CAS acting and running as an OpenID Connect provider. Additional details will be made public once the security grace window has passed. For additional de…
This is an Apereo CAS project vulnerability disclosure, describing an issue in the Java CAS Client while validating tickets issued as JWT. For additional details on how security issues, patches and announcements are handled, please read the…
External identity providers registered with CAS, such as those that speak the OpenID Connect or SAML2 protocol largely remain static throughout the server lifecycle. Once built and available, their configuration remains in read-only mode an…
This is an Apereo CAS project vulnerability disclosure, describing an issue in CAS while using a token-based JWT Authentication feature. For additional details on how security issues, patches and announcements are handled, please read the A…
This is a task planned through NLNet funding. When it comes to the CAS server, performance is generally not a concern. Going with the defaults should be enough in 99% of cases. However, in some rare edge cases, the performance of the servic…
Configuration sources that supply properties and settings to Apereo CAS server deployments generally tend to be static. Their main responsibility is to feed the server a collection of properties and settings, typically very early on during
We’re excited to share that the Apereo CAS project has been awarded funding from NLnet, through the NGI0 Commons Fund, to support the development of CAS — an initiative aimed at strengthening open, sovereign, and self-hosted identity infras…
This is an Apereo CAS project vulnerability disclosure, describing an issue in CAS acting as an OAuth/OpenID Connect provider. For additional details on how security issues, patches and announcements are handled, please read the Apereo CAS
This is an Apereo CAS project vulnerability disclosure, describing an issue in CAS acting as a simple multifactor authentication provider. For additional details on how security issues, patches and announcements are handled, please read the…