CVE-2026-9090: Casdoor Authentication Bypass Vulnerability
Summary
CVE-2026-9090: Casdoor has an authentication bypass. Affects github.com/casdoor/casdoor versions < 1.1000.1-0.20260321120606-239e8bd69487. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Casdoor is an open-source identity and access management platform that provides authentication and authorization services for applications. It supports various authentication protocols, including SAML, OAuth, and OpenID Connect. The platform is designed to simplify user management and enhance security for applications. However, certain versions of Casdoor are vulnerable to an authentication bypass issue, which can compromise the security of applications relying on it.
Vulnerability Detail
Casdoor versions 2.362.0 and earlier contain a critical vulnerability that allows attackers to bypass authentication mechanisms. This issue arises from the buildSpCertificateStore function, which extracts the X.509 certificate directly from the incoming SAMLResponse instead of validating it against a trusted pre-configured Identity Provider certificate. As a result, an attacker can forge assertions signed with a maliciously controlled key, leading to unauthorized access to sensitive resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your application does not accept SAML responses from untrusted sources. Implement additional validation checks on the incoming SAMLResponse to verify the authenticity of the signing certificate before processing it.
Conclusion
The authentication bypass vulnerability in Casdoor (CVE-2026-9090) poses a significant risk to applications relying on this platform for user authentication. It is crucial for users to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for github.com/casdoor/casdoor →
FAQ
CVE-2026-9090 is a vulnerability in Casdoor that allows attackers to bypass authentication by using a forged signing certificate.
Casdoor versions 2.362.0 and earlier are affected by this vulnerability.
If exploited, this vulnerability can allow unauthorized users to gain access to sensitive resources and data within applications using Casdoor for authentication.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/casdoor/casdoor.
