CAS issues with 5.1.6

[Mark Y. Goh]

Hi -
I ran into a problem with 5.1.6 - where certain CAS tickets are rejected,
we have not been able to figure out why some tickets are accepted and some
are not. I assume this behavior is related to CVE-2025-41242  [1] as it
does not seem to occur with 5.1.4.

Three of our CAS apps were affected: koha, webcheckout, and homegrown
django apps using CAS-NG.

this is an example of an error i see for a rejected ticket from our an
inhouse python app:
2025-09-18T16:53:40.621203635Z||https://
<OUR_APP>/login/?next=%2F|ST-<CAS_TICKET>|||||||||||TicketExpired|INVALID_TICKET|||python-requests/2.27.1

Has anyone else run into this issue? Is this a problem on the cas sp side?

mark
[1] https://shibboleth.net/community/advisories/secadv_20250826.txt
-- 

Mark Y. Goh (he/him), Site Reliability Engineer, California College of
the Arts, mgoh at cca.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250918/f2befcf5/attachment.htm>