PatchSiren cyber security CVE debrief

CVE-2026-9094 Casdoor CVE debrief

A cross-organization token exchange vulnerability exists in Casdoor versions 2.362.0 and earlier. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but fails to verify that the token's user belongs to the same organization as the target application. This missing authorization check enables privilege escalation across organizational boundaries, allowing an authenticated user from one organization to obtain tokens for applications in other organizations. The vulnerability was disclosed on 2026-05-28 and is currently in Deferred status per NVD. No known exploitation in ransomware campaigns has been reported.

Vendor: Casdoor
Product: Unknown
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-28
Advisory published: 2026-05-28
Advisory updated: 2026-05-28

Who should care

Organizations running Casdoor identity and access management platform for multi-tenant or multi-organization deployments; security teams managing OAuth 2.0 token exchange implementations; Casdoor administrators responsible for cross-organization access controls

Technical summary

The vulnerability resides in the GetTokenExchangeToken function within object/token_oauth.go. While JWT signature validation is performed, the implementation lacks verification that the authenticated user belongs to the same organization as the target application for which tokens are being exchanged. This authorization gap permits authenticated users to exchange tokens across organizational boundaries, resulting in privilege escalation. The flaw is structural in the token exchange flow and affects all deployments running version 2.362.0 or earlier.

Defensive priority

high

Recommended defensive actions

Upgrade Casdoor to a version newer than 2.362.0 when available
Review application logs for cross-organization token exchange requests prior to patch deployment
Implement additional authorization checks at the application layer to validate user-organization membership before token exchange
Monitor for anomalous token requests across organizational boundaries
Subscribe to vendor security advisories for Casdoor to receive patch notifications

Evidence notes

Vulnerability description sourced from official CVE record. Affected versions confirmed as 2.362.0 and earlier. VulnStatus: Deferred per NVD source data. CERT/CC reference provided but no additional technical details available in supplied corpus.

Official resources

2026-05-28