Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow conversation state due to keystream reuse caused by a fixed all-zero IV paired with the same encryption key.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-02 | 3 | Disclosure2Patch1 |
| 2026-07-03 | 1 | Disclosure1 |
🚨 CVE-2026-59099 — CVSS 9.1/10 █████████░ Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/9vApkCpgea
Post summary
The tweet announces a critical cryptographic vulnerability (CVE-2026-59099) affecting Apereo CAS 7.3.0, ratings it CVSS 9.1/10, and urges to apply the available patch.
🚨 CRITICAL: CVE-2026-59099 — Apereo CAS CVSS 9.1 (3.1) / 9.3 (4.0). AES-GCM nonce reuse (fixed all-zero IV) allows unauthenticated attackers to decrypt webflow state and forge tokens. 🔗 https://threataft.com/articles/cve-2026-59099-apereo-cas-aes-gcm-nonce-reuse #CyberSecurity #ThreatIntel #infosec #SSO
Post summary
The article announces CVE-2026-59099, a critical AES‑GCM nonce reuse flaw in Apereo CAS, enabling decryption of webflow state and token forging by unauthenticated attackers; no exploitation evidence or patch information is provided.
🚨*CVE* CVE-2026-59099 Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by explo… https://www.cve.org/CVERecord?id=CVE-2026-59099 ----- Traducción: CVE-2026-59099 Ape… http://infoflow.cloud`
Post summary
The provided text announces CVE-2026-59099 as a cryptographic flaw in Apereo CAS that permits remote unauthenticated attackers to recover plaintext conversation data, with no mention of a PoC, exploit code, active use, or patch.
CVE-2026-59099 Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by explo… https://www.cve.org/CVERecord?id=CVE-2026-59099
Post summary
The advisory discloses a cryptographic flaw in Apereo CAS 7.3.0‑8.0.0‑RC6 that permits remote unauthenticated attackers to gain plaintext conversation state.