CAS issues with 5.1.6

[Ray Bon]

Mark,

Is it possible that these tickets are in fact expired?
Ticket life is short(ish), say 10s (though I am not sure what the default is) [1].

Ray
[1] https://shibboleth.net/api/java-identity-provider/5.1.6/net/shibboleth/idp/cas/config/ValidateConfiguration.html DEFAULT_TICKET_VALIDITY_PERIOD
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Mark Y. Goh via users <users at shibboleth.net>
Sent: September 18, 2025 13:47
To: users at shibboleth.net <users at shibboleth.net>
Cc: Mark Y. Goh <mgoh at cca.edu>
Subject: CAS issues with 5.1.6

Hi -
I ran into a problem with 5.1.6 - where certain CAS tickets are rejected, we have not been able to figure out why some tickets are accepted and some are not. I assume this behavior is related to CVE-2025-41242  [1] as it does not seem to occur with 5.1.4.

Three of our CAS apps were affected: koha, webcheckout, and homegrown django apps using CAS-NG.

this is an example of an error i see for a rejected ticket from our an inhouse python app:
2025-09-18T16:53:40.621203635Z||https://<OUR_APP>/login/?next=%2F|ST-<CAS_TICKET>|||||||||||TicketExpired|INVALID_TICKET|||python-requests/2.27.1

Has anyone else run into this issue? Is this a problem on the cas sp side?

mark
[1] https://shibboleth.net/community/advisories/secadv_20250826.txt
--

Mark Y. Goh (he/him), Site Reliability Engineer, California College of the Arts, mgoh at cca.edu<mailto:mgoh at cca.edu>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250918/53fddf72/attachment.htm>