{"id":"CVE-2020-27178","aliases":["GHSA-q39c-5vh5-vw2p"],"url":"https://o3.security/vulnerability/CVE-2020-27178","summary":"Improper Authentication in Apereo CAS","details":"Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.","published":"2020-10-16T16:15:11.573Z","modified":"2026-08-27T08:40:52.795639Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.apereo.cas:cas-server-webapp","fixedVersion":"5.3.16"},{"ecosystem":"Maven","name":"org.apereo.cas:cas-server-webapp","fixedVersion":"6.1.7.2"},{"ecosystem":"Maven","name":"org.apereo.cas:cas-server-webapp","fixedVersion":"6.2.4"},{"ecosystem":"Maven","name":"org.apereo.cas:cas-server-support-otp-mfa-core","fixedVersion":"5.3.16"},{"ecosystem":"Maven","name":"org.apereo.cas:cas-server-support-otp-mfa-core","fixedVersion":"6.1.7.2"},{"ecosystem":"Maven","name":"org.apereo.cas:cas-server-support-otp-mfa-core","fixedVersion":"6.2.4"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://apereo.github.io/2020/10/14/gauthvuln/"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T08:40:52.795639Z"}}