CVE-2021-42567: Apereo Central Authentication Service

Medium severity, CVSS 6.1. EPSS: 8.2% chance of exploitation in the next 30 days.

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.

Affected products

• Apereo Central Authentication Service: from 6.3.0, before 6.3.7.1 (fixed in 6.3.7.1); from 6.4.0, before 6.4.2 (fixed in 6.4.2)

Published 2021-12-07. Last modified 2026-06-17.