CVE-2026-9094: Casdoor Critical Vulnerability in Token Exchange Bypass
Summary
CVE-2026-9094: Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check. Affects github.com/casdoor/casdoor versions < 2.387.0. Fixed in 2.387.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Casdoor is an open-source identity and access management platform that provides user authentication and authorization services. It allows organizations to manage user identities and permissions across various applications. The platform supports multiple authentication methods and integrates with various third-party services. However, a critical vulnerability has been identified in versions 2.362.0 and earlier, which affects the security of token exchanges between different organizations.
Vulnerability Detail
The vulnerability arises from the GetTokenExchangeToken function in the object/token_oauth.go file, which validates JWT signatures but fails to check if the token's user belongs to the same organization as the target application. This oversight can lead to privilege escalation, allowing users from one organization to access resources and functionalities of another organization, potentially compromising sensitive data and security protocols.
How To Fix
Latest published version: v1.1000.0 as of 23 Oct 2026
go get github.com/casdoor/casdoor@v1.1000.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.387.0
This is the first release that contains the fix.
go get github.com/casdoor/casdoor@v2.387.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application to verify that the user associated with the JWT token belongs to the same organization as the target application before allowing any token exchange. This can be done by modifying the token validation logic to include organization checks.
Conclusion
The Casdoor vulnerability CVE-2026-9094 poses a significant risk due to its potential for privilege escalation across organizational boundaries. It is crucial to update to the patched version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for github.com/casdoor/casdoor →
FAQ
The vulnerability allows users from one organization to access resources of another organization, leading to potential data breaches and unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Yes, a patch is available in version 2.387.0 and later of the Casdoor package.
If you cannot update the package immediately, implement additional organization checks in your token validation logic as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/casdoor/casdoor.
