GHSA-gv4m-v8c8-hr3g CVE-2026-9091 GO-2026-5896
Casdoor allows users to bypass configured MFA requirements
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.32%
- Chance of exploitation in the next 30 days. Higher than 25.24% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
- None yet
- No fixed version published
Description
Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/casdoor/casdoor | <= 1.1000.1-0.20260321120606-239e8bd69487 |
No fix yet |
| github.com/casdoor/casdoor | all versions |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mfvp-7p3v-x9mh Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-339w-3hqm-9pjc Casdoor doesn't verify that a JWT used for token exchange is still active | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-rgq2-93gj-ffxg Casdoor doesn't enforce SAML assertion time bounds | High | Also affects github.com/casdoor/casdoor |
| GHSA-c9w5-qp6m-m395 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-3w4h-g9f5-j84p Casdoor does not validate the AudienceRestriction element in SAML assertions | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-fwgq-j9r9-qjgr Casdoor has an authentication bypass | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-rmxx-v9rj-vpvg Casdoor: Arbitrary file write possible through Local File System storage provider | Medium | Also affects github.com/casdoor/casdoor |
| GHSA-p8c7-hjc4-gwf8 Casdoor vulnerable to SSRF via crafted Webhook URL | High | Also affects github.com/casdoor/casdoor |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor