CVE-2026-9093: Casdoor SAML AudienceRestriction Validation Bypass Vulnerability
Summary
CVE-2026-9093: Casdoor does not validate the AudienceRestriction element in SAML assertions. Affects github.com/casdoor/casdoor versions < 1.1000.1-0.20260321120606-239e8bd69487. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Casdoor is an open-source identity and access management platform that provides authentication and authorization services for applications. It supports various protocols, including SAML (Security Assertion Markup Language), which is widely used for single sign-on (SSO) implementations. The platform is designed to facilitate secure user management and streamline access control across different services. However, certain versions of Casdoor have a critical vulnerability related to the validation of SAML assertions, specifically the AudienceRestriction element, which can lead to unauthorized access.
Vulnerability Detail
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation fails to validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go does not set the AudienceURI on the gosaml2 SAMLServiceProvider struct and neglects to inspect WarningInfo.NotInAudience. This oversight allows assertions intended for other service providers to be accepted by Casdoor, potentially leading to unauthorized access and data breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your SAML assertions are strictly validated before being processed by Casdoor. You can implement additional checks in your application to verify the AudienceRestriction element manually until you can upgrade to a secure version.
Conclusion
The vulnerability identified as CVE-2026-9093 in Casdoor poses a significant risk due to its failure to validate the AudienceRestriction element in SAML assertions. Users are strongly advised to update to a secure version to mitigate potential unauthorized access risks. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for github.com/casdoor/casdoor →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Casdoor versions 2.362.0 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive data and services, as it allows SAML assertions from other service providers to be accepted.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/casdoor/casdoor.
