CVE-2026-9090: Casdoor has an authentication bypass
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.
Published May 28, 2026 · Updated Jul 2, 2026
Affected packages
github.com/casdoor/casdoor
- Ecosystem
- Go
- Affected
- <= 1.1000.1-0.20260321120606-239e8bd69487
- Fixed in
- No patched version yet
- Check
go list -m github.com/casdoor/casdoor
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Go vulnerabilities
All Go entriesCVE-2026-9093
Casdoor does not validate the AudienceRestriction element in SAML assertions
critical9.8No fixMay 28, 2026CVE-2026-9094
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
critical9.8May 28, 2026CVE-2026-9097
Casdoor doesn't verify that a JWT used for token exchange is still active
critical9.8No fixMay 28, 2026CVE-2026-9098
Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest
critical9.1No fixMay 28, 2026