VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/casdoor/casdoor: vulnerability history, versions and safety

github.com/casdoor/casdoor is a package in the Go ecosystem. Vulert records 39 vulnerabilities for it across 120 releases, from Feb 2022 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
39 vulnerabilities recorded C6 H5 M7 L2 U19
i
30 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
23 in the last 12 months

Most recent disclosure 17 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/casdoor/casdoor vulnerabilities

Vulert verdict on github.com/casdoor/casdoor v1.1000.0 i

Updated on 22 Oct 2026

Careful: v1.1000.0 has 37 known vulnerabilities, and 28 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Active

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.1000.0 — affected i
  • Vulnerabilities on record 39 over 4 years · 23 in the last year i
  • Latest disclosure 17 Jul 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 30 i
  • Stars 14,608 i
  • Last release 14 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/casdoor/casdoor, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.1000.1-0.20261021120621-69cc689b53c7 21 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261020181326-1b91d9d319a1 20 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261019152742-f11d6aca9ef0 19 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261017130109-2e0a10c97d94 17 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261015042752-874306a826de 15 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261013124347-2e1127cf56b1 13 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261013095844-44b96dee5c73 13 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261011123356-fd7295a616ac 11 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261011042530-ef7754b1a55e 11 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261009155808-43a6aabc68d7 09 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261008180916-7dbcbf2fc2e2 08 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261007183923-0d4524ee5171 07 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261007154030-3aa0319e0ef6 07 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261007130723-5c20928ffa15 07 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261007050437-bc93b03f9c32 07 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20261005075126-872c4bf4c2f7 05 Oct 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260930084228-c9adca039f3c 30 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260929172413-e24a90781086 29 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260928121226-8eb7b2ec0ae4 28 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260927180559-8d26455d1c40 27 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260924162450-0f7d6842f23f 24 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260920151817-5370339c113a 20 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260920092920-5565c822e762 20 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260919172008-bef49490341f 19 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260919153714-0352f4beaa50 19 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260918120612-6a635bc41df1 18 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260917155604-30f94bdf1005 17 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260916150927-1d654279a186 16 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260916104429-15e3c21022c1 16 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260916102623-f82480a87052 16 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260916101040-322f84dfae70 16 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260914161401-0f629ebed972 14 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260914023440-e7f279996ac4 14 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260912062302-ed417c14ba39 12 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260907134918-3d51fc26f454 07 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260907065636-8e48365a05a8 07 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260906150122-cc39a9395698 06 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260905153436-aec15f8a74cc 05 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260905064215-a2fb878547a9 05 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260903142105-92a601cd611f 03 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260902152958-f3be685a237a 02 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260902121032-18cb9aec4a5c 02 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260902090736-9603cddddb84 02 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260902090451-377c87a8054c 02 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260902021211-e3438046b620 02 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260901174852-babdb25bf438 01 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260901114837-3659a08ac65b 01 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260901050405-9b8ddd5d6c46 01 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260901035223-540c97d69cfd 01 Sep 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260830161030-54df9ccdaa9a 30 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260828175159-a551ab77480b 28 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260825163116-5f08e4c81e50 25 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260821093539-2aa8b7615399 21 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260818134519-edfbb9323be4 18 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260813151556-7d2ad5faba83 13 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260811143202-7325999791de 11 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260810032634-b30076f74145 10 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260809064933-8b6b9788f6dd 09 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260806141125-cdd805c39f60 06 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260804060609-8799cfee42fa 04 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260803171959-fffa9202c153 03 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260801104138-23139136fdb4 01 Aug 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260724163043-8bb6c391480b 24 Jul 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260721075415-e3003a436f22 21 Jul 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v0.0.0-20260717165816-50e77ade0ee9 17 Jul 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260717165816-50e77ade0ee9 17 Jul 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260705133817-a4a5184d0b5c 05 Jul 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260704175154-88d5aeda9ef2 04 Jul 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260702151051-5389dee0ec11 02 Jul 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260630022225-06aeb81f4d47 30 Jun 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260622095545-c0ccc697765a 22 Jun 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260620121157-696bcf0585c6 20 Jun 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260617140907-8af1a62ef461 17 Jun 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260615064453-fa7594ce75a3 15 Jun 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260605151841-adf5f5ab8974 05 Jun 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260602090149-a0ace4d6a0f1 02 Jun 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260524134933-0585ecff0b9d 24 May 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260401041344-2ebe3f1d5d32 01 Apr 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260327133923-e5d2feb73d70 27 Mar 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260323034706-f5af87683d5e 23 Mar 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260322064014-487992697743 22 Mar 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260322045003-7148c9db85cc 22 Mar 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260321120606-239e8bd69487 21 Mar 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260314150722-6a263cb5cbb6 14 Mar 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260310101212-0bbbb48af1cd 10 Mar 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260215143559-1731b74fa0a2 15 Feb 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260202180008-c8973e6c9e34 02 Feb 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260131143729-a9ae9394c702 31 Jan 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20260105133834-93fefed6e87f 05 Jan 2026 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v0.0.0-20251229122902-8c9331932b36 29 Dec 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251229122902-8c9331932b36 29 Dec 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251211141024-4d5bf09b3684 11 Dec 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251114183515-37e22f3e2c88 14 Nov 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251112123944-68cde65d84e3 12 Nov 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251110171216-0a9a9117e583 10 Nov 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251101062639-f8e5fedf8b65 01 Nov 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251030151359-a533212d8a84 30 Oct 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251030141655-53e1813dc8c5 30 Oct 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251030094448-ba95c7ffb02e 30 Oct 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251029155919-10105de41858 29 Oct 2025 C6 H5 M6 L2 U18 Apache-2.0 No Details →
v1.1000.1-0.20251026170103-61c8e08eb03e 26 Oct 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20251025154602-7b2666d23e58 25 Oct 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20251024175024-b7b6d2377a4f 24 Oct 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20251023140009-bb33c8ea3145 23 Oct 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20251020172753-c3eea4d895f5 20 Oct 2025 C6 H5 M6 L2 U18 — No Details →
v0.0.0-20251015112549-9c89705a19d2 15 Oct 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20251015112549-9c89705a19d2 15 Oct 2025 C6 H5 M6 L2 U18 — No Details →
v0.0.0-20250918154600-d883db907bb6 18 Sep 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250918154600-d883db907bb6 18 Sep 2025 C6 H5 M6 L2 U18 — No Details →
v1.993.1-0.20250918154600-d883db907bb6 18 Sep 2025 C6 H5 M6 L2 U18 — No Details →
v1.996.1-0.20250918154600-d883db907bb6 18 Sep 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250918024147-8e7efe5c23e4 18 Sep 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250908101352-2ab85c0c4476 08 Sep 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250829035152-f26f56e88b66 29 Aug 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250819081828-9f187f690eef 19 Aug 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250819053135-fe5aa1f214af 19 Aug 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250818181915-eda742a84845 18 Aug 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250818003432-83df077a02a0 18 Aug 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250812021300-a3a142db3931 12 Aug 2025 C6 H5 M6 L2 U18 — No Details →
v1.1000.1-0.20250811084615-3bb7cc6b8111 11 Aug 2025 C6 H5 M6 L2 U18 — No Details →

The newest 120 of 2,535 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 3
  • 2023 1
  • 2024 9
  • 2025 4
  • 2026 22

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 23 of the 39 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/casdoor/casdoor

The 5 most severe of 39 vulnerabilities recorded for this package

Search all 39 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2026-9097: Casdoor Token Exchange Vulnerability Due to Inactive JWT Verification 9.8 critical No fix published 28 May 2026
CVE-2026-9093: Casdoor SAML AudienceRestriction Validation Bypass Vulnerability 9.8 critical No fix published 28 May 2026
CVE-2026-9094: Casdoor Critical Vulnerability in Token Exchange Bypass 9.8 critical 2.387.0 28 May 2026
CVE-2026-9090: Casdoor Authentication Bypass Vulnerability 9.1 critical No fix published 28 May 2026
CVE-2026-9098: Casdoor SAML Callback Handler Vulnerability Allows Unauthorized Access 9.1 critical No fix published 28 May 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 22/Oct/2026 · Vulnerabilities in our DB: 524173

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/casdoor/casdoor

Is github.com/casdoor/casdoor safe to use?

Vulert records 39 vulnerabilities for github.com/casdoor/casdoor in Go: 6 critical, 5 high, 7 medium and 2 low, plus 19 not yet rated. 30 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/casdoor/casdoor's Vulert package health score?

Vulert scores github.com/casdoor/casdoor 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/casdoor/casdoor affected?

Yes. v1.1000.0, the version you would install today, has 37 known vulnerabilities, and 28 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

How many vulnerabilities does github.com/casdoor/casdoor have?

39 vulnerabilities are recorded for github.com/casdoor/casdoor in the Go ecosystem: 6 critical, 5 high, 7 medium and 2 low, plus 19 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/casdoor/casdoor vulnerabilities disclosed?

23 vulnerabilities were recorded for github.com/casdoor/casdoor in the last 12 months, and the oldest entry in this database dates to 01 Feb 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/casdoor/casdoor are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/casdoor/casdoor for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/casdoor/casdoor version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.