CVE-2026-9097: Casdoor Token Exchange Vulnerability Due to Inactive JWT Verification
Summary
CVE-2026-9097: Casdoor doesn't verify that a JWT used for token exchange is still active. Affects github.com/casdoor/casdoor versions < 1.1000.1-0.20260321120606-239e8bd69487. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Casdoor is an open-source identity and access management platform that provides features such as user authentication, authorization, and management of user sessions. It is built using Go and is widely used for securing applications. However, versions 2.362.0 and earlier have a critical vulnerability that affects the security of token exchanges.
Vulnerability Detail
The vulnerability arises from Casdoor's failure to verify whether a JSON Web Token (JWT) used for token exchange is still active. The GetTokenExchangeToken() function in the object/token_oauth.go file validates the JWT signature and parses its claims but does not check the Token table to see if the subject token has been revoked or invalidated. This lack of a revocation check allows compromised tokens to remain active, posing a significant security risk as administrators cannot terminate active sessions or revoke tokens that may have been compromised.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can manually monitor and revoke tokens by implementing additional checks in their application logic until the package is updated. However, this is not a recommended long-term solution.
Conclusion
The Casdoor vulnerability CVE-2026-9097 highlights a critical issue in the handling of JWTs for token exchanges. It is essential for users of affected versions to update to the latest version to mitigate security risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for github.com/casdoor/casdoor →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Casdoor versions 2.362.0 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include unauthorized access to user sessions and the inability to revoke compromised tokens, which can lead to data breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/casdoor/casdoor.
