These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. The function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation is affected, allowing for server-side request forgery through manipulation of the argument pgtUrl. The attack may be performed from remote. Upgrading to version 4.11.0 addresses this issue.
A vulnerability was detected in Casdoor up to 3.161.1, affecting the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint, leading to missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. This issue requires immediate attention from defenders responsible for Casdoor instances up to version 3.161.1 and API Endpoints. They sh [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-15T12:17:55.407Z and has not been modified since then. The vulnerability is an authorization bypass in Casdoor through 4.4.0, allowing attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. This could lead to enumeratio [truncated]
CVE-2026-90942 debrief based on the supplied source corpus. The CVE record was published on 2026-09-14T18:20:28.720Z. Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. This exposure can lead to potential JWT token forgery for any user in any organization, includ [truncated]
A vulnerability in Casdoor up to version 4.0.0 allows for missing authentication via the upload-resource API. This issue, tracked as CVE-2026-84423, was publicly disclosed and may be exploited remotely. The vendor removed a related GitHub issue without explanation and did not respond to disclosure emails. The vulnerability affects the upload-resource API, which is used for managing resources in Casdoor. D [truncated]
A critical vulnerability exists in Casdoor, allowing a non-global organization admin to bypass tenant boundaries and perform unauthorized actions on resources in other tenants. This issue arises from a mismatch between authorization and action based on request parameters. The vulnerability allows unauthorized actions such as delete, create, or modify resources across tenants. Defenders and administrators [truncated]
CVE-2026-9098 describes an authentication bypass vulnerability in Casdoor versions 2.362.0 and earlier affecting the SAML callback handler. The vulnerability stems from two related weaknesses in the SAML assertion consumer service (ACS) implementation at `/api/acs`. First, the handler accepts any well-formed SAMLResponse without verifying that it corresponds to a previously issued AuthnRequest, violating [truncated]
Casdoor versions 2.362.0 and earlier contain a missing authorization vulnerability in the token exchange flow. The GetTokenExchangeToken() function in object/token_oauth.go validates JWT signatures and parses claims but fails to query the Token table to verify whether the subject token has been revoked or invalidated. This omission prevents administrators from terminating active sessions or revoking compr [truncated]
Casdoor versions 2.362.0 and earlier contain a SAML authentication bypass vulnerability. The application uses the gosaml2 library for SAML response processing, which correctly computes time-validation results including NotOnOrAfter and NotBefore constraints. However, the ParseSamlResponse() function in Casdoor never reads the assertionInfo.WarningInfo field where these validation results are reported. Con [truncated]
CVE-2026-9095 is a HIGH-severity authentication bypass vulnerability in Casdoor versions 2.362.0 and earlier, published 2026-05-28. The vulnerability stems from missing replay protection in the SAML service provider implementation. Specifically, the ParseSamlResponse() function in object/saml_sp.go processes SAML assertions without validating assertion IDs against a cache, enforcing OneTimeUse conditions, [truncated]
A cross-organization token exchange vulnerability exists in Casdoor versions 2.362.0 and earlier. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but fails to verify that the token's user belongs to the same organization as the target application. This missing authorization check enables privilege escalation across organizational boundaries, allowing an authenticated u [truncated]
A missing audience validation vulnerability in Casdoor's SAML service provider implementation allows cross-service provider assertion acceptance.
Casdoor versions 2.362.0 and earlier contain an authentication bypass vulnerability in the identity provider (IdP) email binding flow. The `getExistUserByBindingRule` function matches existing user accounts by email address without verifying whether the upstream IdP has confirmed email ownership. The `idp.UserInfo` struct lacks an `EmailVerified` field entirely, preventing any validation of the `email_ver [truncated]
A logic flaw in Casdoor versions 2.362.0 and earlier allows MFA bypass during social-login binding. The binding-rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable, permitting authentication without enforced MFA.
A security flaw has been discovered in Casdoor 2.356.0, affecting the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. This vulnerability has a CVSS score of 2 and is considered Low severity. Users of Casdoor 2.356.0 should be aware of this cross site scripting vulnerability [truncated]