GitHub Advisoryadvisory · Go

GHSA-fwgq-j9r9-qjgr Casdoor has an authentication bypass

CRITICAL Published 2026-05-28 Modified 2026-07-02 Official page ↗
Aliases
CVE-2026-9090
Ecosystem
Go
Packages
github.com/casdoor/casdoor
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287
Reviewed
2026-07-02

Affected packages

• Go github.com/casdoor/casdoor: <= 1.1000.1-0.20260321120606-239e8bd69487 (no fix yet)

Description

Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.

Related

Alias · CVE (1)

  • CVE-2026-9090 Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References