CVE-2026-59099

Katalog CVE

CVSS 9.1 · Critical EPSS 0,55%

Kerentanan Reusing a Nonce, Key Pair in Encryption. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow conversation state due to keystream reuse caused by a fixed all-zero IV paired with the same encryption key.

Rincian

Terbit di NVD

2 Juli 2026

Terakhir diubah

14 Juli 2026

Status NVD

Awaiting Analysis

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-323: Reusing a Nonce, Key Pair in Encryption

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://apereo.github.io/2026/06/18/vuln/
• https://github.com/apereo/cas/commit/22c6f4adf738852782309b523b4e80371057f2d0
• https://github.com/apereo/cas/releases/tag/v8.0.0-RC6
• https://github.com/geo-chen/oss/blob/main/cas.md
• https://www.vulncheck.com/advisories/apereo-cas-rc6-aes-gcm-nonce-reuse-information-disclosure