PT-2026-55346 · Go · Github.Com/Casdoor/Casdoor

Publicado 2026-05-28 · Atualizado 2026-05-28

OSV

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.

Correção

Enumeração de Fraquezas

CWE-298

Identificadores relacionados

GHSA-339W-3HQM-9PJC

Produtos afetados

Github.Com/Casdoor/Casdoor

Referências · 4

• https://github.com/casdoor/casdoor · Nota
• https://kb.cert.org/vuls/id/780781 · Nota
• https://osv.dev/vulnerability/GHSA-339w-3hqm-9pjc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-9097 · Nota de Segurança