PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9097 Casdoor CVE debrief

Casdoor versions 2.362.0 and earlier contain a missing authorization vulnerability in the token exchange flow. The GetTokenExchangeToken() function in object/token_oauth.go validates JWT signatures and parses claims but fails to query the Token table to verify whether the subject token has been revoked or invalidated. This omission prevents administrators from terminating active sessions or revoking compromised tokens, as the revocation check is entirely absent from the implementation.

Vendor
Casdoor
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-02
Advisory published
2026-05-28
Advisory updated
2026-06-02

Who should care

Organizations using Casdoor for identity and access management, particularly those relying on token revocation for incident response or compromised credential handling. Security teams responsible for OAuth/OIDC implementation security and session lifecycle management.

Technical summary

The vulnerability exists in the OAuth token exchange implementation where JWT validation is incomplete. While cryptographic signature verification and claim extraction are performed, the system does not verify whether the token has been administratively revoked. This creates a gap between token lifecycle management (revocation capability) and token validation logic, effectively rendering revocation operations non-functional for token exchange flows.

Defensive priority

high

Recommended defensive actions

  • Review Casdoor token exchange implementation in object/token_oauth.go to confirm GetTokenExchangeToken() behavior
  • Implement Token table query to verify revocation status before completing token exchange
  • Establish token lifecycle management procedures including explicit revocation checks for all token types
  • Monitor for updates to Casdoor addressing this vulnerability
  • Consider implementing additional session monitoring and anomaly detection for token exchange patterns

Evidence notes

The vulnerability description indicates that signature validation and claim parsing occur without subsequent revocation status verification against the Token table. The CVE was published on 2026-05-28 and modified later the same day. No CVSS score or severity rating is currently available in the source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9097 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9097

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9097 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9097

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.