PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9094 Casdoor CVE debrief

A cross-organization token exchange vulnerability exists in Casdoor versions 2.362.0 and earlier. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but fails to verify that the token's user belongs to the same organization as the target application. This missing authorization check enables privilege escalation across organizational boundaries, allowing an authenticated user from one organization to obtain tokens for applications in other organizations. The vulnerability was disclosed on 2026-05-28 and is currently in Deferred status per NVD. No known exploitation in ransomware campaigns has been reported.

Vendor
Casdoor
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-02
Advisory published
2026-05-28
Advisory updated
2026-06-02

Who should care

Organizations running Casdoor identity and access management platform for multi-tenant or multi-organization deployments; security teams managing OAuth 2.0 token exchange implementations; Casdoor administrators responsible for cross-organization access controls

Technical summary

The vulnerability resides in the GetTokenExchangeToken function within object/token_oauth.go. While JWT signature validation is performed, the implementation lacks verification that the authenticated user belongs to the same organization as the target application for which tokens are being exchanged. This authorization gap permits authenticated users to exchange tokens across organizational boundaries, resulting in privilege escalation. The flaw is structural in the token exchange flow and affects all deployments running version 2.362.0 or earlier.

Defensive priority

high

Recommended defensive actions

  • Upgrade Casdoor to a version newer than 2.362.0 when available
  • Review application logs for cross-organization token exchange requests prior to patch deployment
  • Implement additional authorization checks at the application layer to validate user-organization membership before token exchange
  • Monitor for anomalous token requests across organizational boundaries
  • Subscribe to vendor security advisories for Casdoor to receive patch notifications

Evidence notes

Vulnerability description sourced from official CVE record. Affected versions confirmed as 2.362.0 and earlier. VulnStatus: Deferred per NVD source data. CERT/CC reference provided but no additional technical details available in supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9094 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9094

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9094 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9094

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.