PT-2026-44425 · Casdoor+1 · Casdoor+1

David Lie + 4 · Published 2026-05-28 · Updated 2026-07-07 · CVE-2026-9096

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.363.0

Description Casdoor fails to enforce SAML assertion time bounds. The gosaml2 library calculates time-validation results, such as NotOnOrAfter and NotBefore, and reports them in the assertionInfo.WarningInfo field. However, the ParseSamlResponse() function does not read this field, causing the time bounds to be discarded before a user session is issued.

Recommendations Update to a version later than 2.362.0.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-9096

GHSA-RGQ2-93GJ-FFXG

GO-2026-5899

Affected Products

Casdoor

Gosaml2

References · 7

• https://osv.dev/vulnerability/GO-2026-5899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9096 · Security Note
• https://osv.dev/vulnerability/GHSA-rgq2-93gj-ffxg · Vendor Advisory
• https://github.com/casdoor/casdoor · Note
• https://twitter.com/VulmonFeeds/status/2060161450333655092 · Twitter Post
• https://kb.cert.org/vuls/id/780781 · Note
• https://github.com/advisories/GHSA-rgq2-93gj-ffxg · Note