PT-2026-44420 · Casdoor · Casdoor

David Lie + 4 · Published 2026-05-28 · Updated 2026-07-07 · CVE-2026-9091

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.362.1

Description A logic flaw exists in the social-login binding flow. The binding-rule code path in 'controllers/auth.go' calls the HandleLoggedIn() function directly without invoking checkMfaEnable(), allowing users to bypass configured Multi-Factor Authentication (MFA) requirements. Consequently, any user authenticating through this path is logged in without MFA enforcement.

Recommendations Update to a version later than 2.362.0. As a temporary workaround, restrict access to the social-login binding flow until the update is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-9091

GHSA-GV4M-V8C8-HR3G

GO-2026-5896

Affected Products

Casdoor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-9091 · Security Note
• https://osv.dev/vulnerability/GO-2026-5896 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gv4m-v8c8-hr3g · Vendor Advisory
• https://github.com/casdoor/casdoor · Note
• https://t.me/cveNotify/165061 · Telegram Post
• https://kb.cert.org/vuls/id/780781 · Note
• https://github.com/advisories/GHSA-gv4m-v8c8-hr3g · Note