GitHub Advisoryadvisory · Go

GHSA-c9w5-qp6m-m395 Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check

CRITICAL Published 2026-05-28 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-9094
Ecosystem
Go
Packages
github.com/casdoor/casdoor
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269, CWE-863
Reviewed
2026-07-09

Affected packages

• Go github.com/casdoor/casdoor: < 2.387.0 → fixed in 2.387.0

Description

Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.

Related

Alias · CVE (1)

  • CVE-2026-9094 Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-863 Incorrect Authorization weakness

References