CVE-2026-90942 casdoor CVE debrief

Who should care

Defenders responsible for Casdoor instances, particularly those with organization administrators who could potentially access these API endpoints, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, restrict access, and plan for remediation.

Why it matters

CVE-2026-90942 allows organization administrators to retrieve the private key via API endpoints, potentially enabling JWT token forgery. Defenders should verify exposure, restrict access, and prioritize remediation.

• Potential JWT token forgery for any user in any organization
• Exposure of private key via API endpoints
• Possible cross-organization token forgery
• Verification of Casdoor instance exposure and remediation priority

Technical summary

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators. This exposure can lead to potential cross-organization token forgery and unauthorized access. Defenders should prioritize verifying exposure and remediating vulnerable Casdoor instances by restricting access to organization administrators and considering upgrades to a fixed version.

Defensive priority

Defenders should prioritize verifying exposure and remediating vulnerable Casdoor instances.

Recommended defensive actions

• Verify Casdoor instance exposure to vulnerable API endpoints
• Retrieve and verify the private key exposure via /api/get-certs and /api/get-cert endpoints
• Restrict access to organization administrators for these endpoints
• Consider upgrading to a fixed version of Casdoor if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references indicate that Casdoor instances through version 4.4.0 expose a private key via API endpoints, allowing potential JWT token forgery. The private key exposure via /api/get-certs and /api/get-cert endpoints enables organization administrators to forge JWT tokens. Defenders should verify exposure and restrict access to these endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.