PT-2026-55403 · Go · Github.Com/Casdoor/Casdoor

Published 2026-05-28 · Updated 2026-05-28

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.

Fix

Weakness Enumeration

CWE-488

Related Identifiers

GHSA-MFVP-7P3V-X9MH

Affected Products

Github.Com/Casdoor/Casdoor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9098 · Security Note
• https://osv.dev/vulnerability/GHSA-mfvp-7p3v-x9mh · Vendor Advisory
• https://github.com/casdoor/casdoor · Note
• https://kb.cert.org/vuls/id/780781 · Note