Vulnerability Database

309,540

Total vulnerabilities in the database

CVE-2020-27178

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.

Published: Oct 16, 2020
Updated: Nov 16, 2025
CVE: CVE-2020-27178
GHSA: GHSA-q39c-5vh5-vw2p
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:P/A:N

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
apereo / central_authentication_service	6.3.0-rc1	6.3.0-rc1.x
apereo / central_authentication_service	6.3.0-rc3	6.3.0-rc3.x
apereo / central_authentication_service	6.3.0-rc2	6.3.0-rc2.x
apereo / central_authentication_service	6.2.0	6.2.4
apereo / central_authentication_service	5.3.0	5.3.16
apereo / central_authentication_service	6.0.0	6.1.7.2
org.apereo.cas / cas-server-webapp	5.3.0	5.3.16
org.apereo.cas / cas-server-webapp	6.0.0	6.1.7.2
org.apereo.cas / cas-server-webapp	6.2.0	6.2.4
org.apereo.cas / cas-server-support-otp-mfa-core	5.3.0	5.3.16
org.apereo.cas / cas-server-support-otp-mfa-core	6.0.0	6.1.7.2
org.apereo.cas / cas-server-support-otp-mfa-core	6.2.0	6.2.4

https://apereo.github.io/2020/10/14/gauthvuln/

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo