CVE-2026-9093: Casdoor does not validate the AudienceRestriction element in SAML assertions
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/samlsp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
Published May 28, 2026 · Updated Jul 2, 2026
Affected packages
github.com/casdoor/casdoor
- Ecosystem
- Go
- Affected
- <= 1.1000.1-0.20260321120606-239e8bd69487
- Fixed in
- No patched version yet
- Check
go list -m github.com/casdoor/casdoor
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Go vulnerabilities
All Go entriesCVE-2026-9090
Casdoor has an authentication bypass
critical9.1No fixMay 28, 2026CVE-2026-9094
Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check
critical9.8May 28, 2026CVE-2026-9097
Casdoor doesn't verify that a JWT used for token exchange is still active
critical9.8No fixMay 28, 2026CVE-2026-9098
Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest
critical9.1No fixMay 28, 2026