GitHub Advisoryadvisory · Go

GHSA-339w-3hqm-9pjc Casdoor doesn't verify that a JWT used for token exchange is still active

CRITICAL Published 2026-05-28 Modified 2026-07-02 Official page ↗
Aliases
CVE-2026-9097
Ecosystem
Go
Packages
github.com/casdoor/casdoor
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-298
Reviewed
2026-07-02

Affected packages

• Go github.com/casdoor/casdoor: <= 1.1000.1-0.20260321120606-239e8bd69487 (no fix yet)

Description

Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.

Related

Alias · CVE (1)

  • CVE-2026-9097 Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. vulnerability

Weakness · CWE (1)

  • CWE-298 Improper Validation of Certificate Expiration weakness

References