GHSA-3w4h-g9f5-j84p CVE-2026-9093 GO-2026-5894
Casdoor does not validate the AudienceRestriction element in SAML assertions
- Severity
- 9.8 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.36%
- Chance of exploitation in the next 30 days. Higher than 30.35% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/casdoor/casdoor | <= 1.1000.1-0.20260321120606-239e8bd69487 |
No fix yet |
| github.com/casdoor/casdoor | all versions |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mfvp-7p3v-x9mh Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-339w-3hqm-9pjc Casdoor doesn't verify that a JWT used for token exchange is still active | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-rgq2-93gj-ffxg Casdoor doesn't enforce SAML assertion time bounds | High | Also affects github.com/casdoor/casdoor |
| GHSA-c9w5-qp6m-m395 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-gv4m-v8c8-hr3g Casdoor allows users to bypass configured MFA requirements | Medium | Also affects github.com/casdoor/casdoor |
| GHSA-fwgq-j9r9-qjgr Casdoor has an authentication bypass | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-rmxx-v9rj-vpvg Casdoor: Arbitrary file write possible through Local File System storage provider | Medium | Also affects github.com/casdoor/casdoor |
| GHSA-p8c7-hjc4-gwf8 Casdoor vulnerable to SSRF via crafted Webhook URL | High | Also affects github.com/casdoor/casdoor |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor