maven package report

Is org.apereo.cas:cas-server-support-otp-mfa-core safe?

1 known vulnerability, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

1.2%

chance of exploitation in the next 30 days

xyz score

3.4

CyberXYZ composite, out of 10

fig. 01 — GHSA-q39c-5vh5-vw2p, the advisory selected below

// advisories

GHSA-q39c-5vh5-vw2p

HIGHCVE-2020-27178

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.

Affected: >= 6.2.0, < 6.2.4, >= 6.0.0, <= 6.1.7.1, >= 5.3.0, < 5.3.16
Fixed in: 6.2.4
Weakness: CWE-287
Published: 2021-08-02
Source: github

GHSA NVD MITRE reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 01:56 UTC. The most recent advisory here was published 2021-08-02. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is org.apereo.cas:cas-server-support-otp-mfa-core safe? maven package security report | CyberXYZ