Skip to content
OpenAdvisories

Vendor

Casdoor

15 known vulnerabilities.

Products

Casdoor 15
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-9096

    CVE-2026-9096

    Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads thi…

    Casdoor Casdoor github.com/casdoor/casdoor Go
  • High 8.1
    CVE-2026-9095

    CVE-2026-9095

    Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertio…

    Casdoor Casdoor
  • High 8.1
    CVE-2024-41657

    GHSL-2024-035: Casdoor CORS misconfiguration

    Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the log…

    Casdoor Casdoor github.com/casdoor/casdoor Go