GitHub Advisoryadvisory · Go

GHSA-mj24-pqx2-6788 Casdoor vulnerable to Open Redirect

LOW Published 2026-04-03 Modified 2026-04-10 Official page ↗
Aliases
CVE-2026-5467
Ecosystem
Go
Packages
github.com/casdoor/casdoor
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-04-10

Affected packages

• Go github.com/casdoor/casdoor: <= 1.1000.0 (no fix yet)

Description

A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirect_uri leads to open redirect. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Related

Alias · CVE (1)

  • CVE-2026-5467 A vulnerability was identified in Casdoor 2.356.0. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References