{"id":"CVE-2020-27178","details":"Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.","aliases":["GHSA-q39c-5vh5-vw2p"],"modified":"2026-08-27T08:40:52.795639Z","published":"2020-10-16T16:15:11.573Z","references":[{"type":"ADVISORY","url":"https://apereo.github.io/2020/10/14/gauthvuln/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apereo/cas","events":[{"introduced":"78f69385c15757a7a75f4c514d00c421db3fd216"},{"fixed":"4b89fab15ff580fc3481f4cbf3bb917bb9fe05c4"},{"introduced":"f0987d714be32ac64ba9e7b5155733936757cf41"},{"fixed":"3f56dfecbec53cd007e36631971dafd037a5a068"},{"introduced":"461b3b0c421cee6ae6863b3e01f5bc34c748eae9"},{"fixed":"60ba4cdd35a279ba8aae8922920099d314576500"},{"introduced":"f4a6c1e6d9914f82c71486d49ad74c069be6eaa9"},{"last_affected":"02c3d72085ded07b24cc3f05af402ae814dcdd40"}],"database_specific":{"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:*","cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc1:*:*:*:*:*:*","cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc2:*:*:*:*:*:*","cpe:2.3:a:apereo:central_authentication_service:6.3.0:rc3:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.3.0"},{"fixed":"5.3.16"},{"introduced":"6.0.0"},{"fixed":"6.1.7.2"},{"introduced":"6.2.0"},{"fixed":"6.2.4"},{"introduced":"6.3.0-rc1"},{"last_affected":"6.3.0-rc1"},{"introduced":"6.3.0-rc2"},{"last_affected":"6.3.0-rc2"},{"introduced":"6.3.0-rc3"},{"last_affected":"6.3.0-rc3"}]}}],"versions":["6.3.0-rc1","6.3.0-rc2","6.3.0-rc3","v6.3.0-RC3","v6.2.3","v6.3.0-RC2","v6.2.2","6.3.0-RC1","v6.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-27178.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}