Apereo CAS AES-GCM IV Reuse Webflow Decryption Vulnerability

Technical Analysis

CVE-2026-59099 stems from improper IV management in AES-GCM mode, where reuse of a static all-zero IV with the same key across the server's lifetime destroys the confidentiality guarantees of GCM and permits keystream recovery via known-plaintext or two-time-pad style attacks. Since the CAS login page is unauthenticated, attackers can repeatedly harvest webflow execution tokens to build a corpus of ciphertexts for cryptanalysis, eventually reconstructing the keystream and decrypting sensitive conversation state such as session attributes or authentication flow data. The CVSS 9.1 score reflects the unauthenticated remote attack vector and high confidentiality impact, with potential downstream risk of session hijacking or authentication logic manipulation if decrypted state includes trust decisions. Organizations using CAS as an SSO identity provider for internal services—including APIs and dashboards used by AI agent orchestration platforms—could see exposed session tokens or credentials leveraged to pivot into agent management consoles or API gateways, indirectly compromising agent authentication chains and any API keys brokered through CAS-protected endpoints.

Affected Systems

Apereo CAS server versions 7.3.0 up to (but not including) 8.0.0-RC6; deployments using default or unmodified AES-GCM webflow encryption configuration; any CAS-based SSO integration acting as an identity broker for downstream applications, APIs, or agent management platforms.

Indicators of Compromise

• No specific file hashes, IPs, or domains published; indicators would be anomalous high-frequency requests to CAS /login or /cas/login endpoints from single sources, repeated retrieval of execution tokens without completing authentication flows.

Remediation Steps

1. 1

   Upgrade CAS

   Update Apereo CAS to version 8.0.0-RC6 or later, which addresses the IV reuse flaw by implementing proper per-encryption random IV generation.

2. 2

   Rotate Cryptographic Keys

   After upgrading, rotate all webflow encryption keys and any derived session secrets to invalidate previously issued tokens that may have been part of the attacker's collected ciphertext corpus.

3. 3

   Monitor Login Endpoint Traffic

   Implement rate limiting and anomaly detection on the CAS login page to detect abnormal volumes of token retrieval requests indicative of ciphertext harvesting.

4. 4

   Audit Downstream Trust Relationships

   Review and audit any services, APIs, or AI agent platforms that rely on CAS-issued sessions or tokens for authentication, ensuring compromised session state cannot be replayed to access sensitive systems.

5. 5

   Enable WAF Protections

   Deploy web application firewall rules to detect and block automated, high-frequency scraping of unauthenticated login page tokens.