Summary
CVE-2026-59099 is a critical cryptographic vulnerability (CVSS 9.1) affecting Apereo CAS (Central Authentication Service) versions 7.3.0 through 8.0.0-RC5. The flaw stems from AES-GCM initialization vector (IV) reuse: a fixed all-zero IV is used with the same encryption key across the server’s entire lifetime to protect client-side webflow conversation state tokens. An unauthenticated remote attacker can collect multiple encrypted webflow execution tokens from the publicly accessible CAS login page, perform known-plaintext cryptanalysis to recover the AES-GCM keystream, and decrypt the webflow conversation state. Apereo has confirmed that the default CAS configuration is affected, placing the vast majority of standard deployments at risk.
Technical details
- Root cause: Apereo CAS encrypts client-side webflow conversation state (the
executiontoken embedded in the login page form) using AES-GCM, but applies a fixed all-zero initialization vector (IV) paired with the same key for the entire server lifetime. IV reuse in AES-GCM is catastrophic: any two ciphertexts produced under the same key and IV share an identical keystream. XOR-ing them cancels the keystream, enabling an attacker to recover plaintext via known-plaintext analysis (classified as CWE-323: Reusing a Nonce, Key Pair in Encryption). - Trigger conditions: No authentication, no user interaction, and no special configuration is required. The vendor’s advisory explicitly states that managing webflow state in the client browser "is the default setup and configuration for almost all deployments," making standard installations vulnerable out of the box.
- Attack vector: An unauthenticated attacker makes multiple requests to the public CAS login endpoint (
/cas/login) to collect a set of encryptedexecutiontokens. Because all tokens are produced with the same key and the same all-zero IV, known-plaintext analysis recovers the keystream and allows decryption of any captured webflow conversation state. - Impact: Confidentiality is rated HIGH — an attacker recovers plaintext webflow conversation state, including authentication context. Integrity is also rated HIGH per the CVSS vector — keystream recovery enables manipulation of encrypted webflow state.
Affected software
- Apereo CAS 7.3.0 through 7.3.7.2 — patched in 7.3.7.3
- Apereo CAS 8.0.0-RC1 through 8.0.0-RC5 — patched in 8.0.0-RC6
Severity
- CVSS v3.1 Base Score: 9.1 CRITICAL
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate action — patch now:
- For 7.3.x branch deployments: upgrade to Apereo CAS 7.3.7.3
- For 8.0.x RC deployments: upgrade to Apereo CAS 8.0.0-RC6
- Both fixes are described by the vendor as drop-in replacements requiring no configuration changes for most deployments.
- If immediate patching is not feasible: Restrict unauthenticated network access to the CAS login endpoint at the perimeter (firewall, reverse proxy, or load balancer) to limit an attacker’s ability to collect execution tokens. This is a temporary measure only and does not resolve the underlying cryptographic flaw.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.