CVE-2026-9098: Casdoor SAML Callback Handler Vulnerability Allows Unauthorized Access
Summary
CVE-2026-9098: In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued b... Affects github.com/casdoor/casdoor versions < 1.1000.1-0.20260321120606-239e8bd69487. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Casdoor is an open-source identity and access management platform that provides authentication and authorization services for applications. It supports various authentication protocols, including SAML, which allows users to log in using their identity provider (IdP). The platform is designed to facilitate secure user management and access control, making it a critical component for applications that require robust security measures. However, a vulnerability in the SAML callback handler compromises its integrity, allowing unauthorized access to user sessions.
Vulnerability Detail
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying its correspondence to an AuthnRequest previously issued by Casdoor. This flaw allows an attacker controlling a registered upstream IdP to send unsolicited SAML responses or replay a legitimately captured response in a different session. Consequently, this vulnerability can lead to persistent unauthorized access, as Casdoor accepts the response and issues a session without proper validation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators should ensure that their IdP configurations are secure and monitor for any unauthorized SAML responses. Additionally, consider implementing additional validation checks on the SAML responses received by the application until the update can be applied.
Conclusion
The vulnerability identified as CVE-2026-9098 in Casdoor poses a significant risk by allowing unauthorized access through improper handling of SAML responses. It is crucial for users to update to the latest version to secure their applications and prevent potential exploitation.
See every vulnerability recorded for github.com/casdoor/casdoor →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Casdoor versions 2.362.0 and earlier are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized access to user sessions, allowing attackers to impersonate users and gain persistent access to the application.
Yes, implementing additional validation checks on SAML responses and ensuring secure IdP configurations can help mitigate the risk until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/casdoor/casdoor.
