PT-2026-30029 · Casdoor · Casdoor

Ghufran Khan · Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-5467

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Casdoor version 2.356.0

Description A flaw exists in the OAuth Authorization Request Handler component that allows for open redirect attacks. Manipulation of the redirect uri argument can be exploited remotely. The exploit is publicly available.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-5467

GHSA-MJ24-PQX2-6788

Affected Products

Casdoor

References · 8

• 🔥 https://vuldb.com/submit/781769 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5467 · Security Note
• https://osv.dev/vulnerability/GHSA-mj24-pqx2-6788 · Vendor Advisory
• https://github.com/casdoor/casdoor · Note
• https://twitter.com/infoflowcloud/status/2040113665135792302 · Twitter Post
• https://vuldb.com/vuln/355071 · Note
• https://twitter.com/CVEnew/status/2040111928333537374 · Twitter Post
• https://vuldb.com/vuln/355071/cti · Note