GHSA-mfvp-7p3v-x9mh CVE-2026-9098 GO-2026-5898
Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest
- Severity
- 9.1 / 10
- Critical · CVSS 3.1
- Exploit chance (EPSS)
- 0.23%
- Chance of exploitation in the next 30 days. Higher than 13.94% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-488 Exposure of Data Element to Wrong Session
- Fix
- None yet
- No fixed version published
Description
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/casdoor/casdoor | <= 1.1000.1-0.20260321120606-239e8bd69487 |
No fix yet |
| github.com/casdoor/casdoor | all versions |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-488: Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
How to prevent it
- Architecture and Design: Protect the application's sessions from information leakage. Make sure that a session's data is not used or visible by other sessions.
- Testing: Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton Member Field).
- Architecture and Design: In a multithreading environment, storing user data in Servlet member fields introduces a data access race condition. Do not use member fields to store information in the Servlet.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-339w-3hqm-9pjc Casdoor doesn't verify that a JWT used for token exchange is still active | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-rgq2-93gj-ffxg Casdoor doesn't enforce SAML assertion time bounds | High | Also affects github.com/casdoor/casdoor |
| GHSA-c9w5-qp6m-m395 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-3w4h-g9f5-j84p Casdoor does not validate the AudienceRestriction element in SAML assertions | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-gv4m-v8c8-hr3g Casdoor allows users to bypass configured MFA requirements | Medium | Also affects github.com/casdoor/casdoor |
| GHSA-fwgq-j9r9-qjgr Casdoor has an authentication bypass | Critical | Also affects github.com/casdoor/casdoor |
| GHSA-rmxx-v9rj-vpvg Casdoor: Arbitrary file write possible through Local File System storage provider | Medium | Also affects github.com/casdoor/casdoor |
| GHSA-p8c7-hjc4-gwf8 Casdoor vulnerable to SSRF via crafted Webhook URL | High | Also affects github.com/casdoor/casdoor |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor