GitHub Advisoryadvisory · Go

GHSA-rgq2-93gj-ffxg Casdoor doesn't enforce SAML assertion time bounds

HIGH Published 2026-05-28 Modified 2026-07-02 Official page ↗
Aliases
CVE-2026-9096
Ecosystem
Go
Packages
github.com/casdoor/casdoor
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-613
Reviewed
2026-07-02

Affected packages

• Go github.com/casdoor/casdoor: <= 1.1000.1-0.20260321120606-239e8bd69487 (no fix yet)

Description

Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2026-9096 Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. vulnerability

References