PT-2026-44424 · Casdoor · Casdoor

David Lie + 4 · Published 2026-05-28 · Updated 2026-05-29 · CVE-2026-9095

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.362.1

Description Casdoor maps SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. The SAML Service Provider (SP) code path lacks an assertion ID cache, OneTimeUse condition enforcement, and replay detection. This allows an attacker to replay a previously captured SAML assertion to obtain an authenticated session for the assertion's subject, including administrator accounts, bypassing the need for passwords or multi-factor authentication (MFA) credentials.

Recommendations Update to a version later than 2.362.0.

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2026-9095

Affected Products

Casdoor

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9095 · Security Note
• https://twitter.com/VulmonFeeds/status/2060153771884212257 · Twitter Post
• https://kb.cert.org/vuls/id/780781 · Note