Skip to content
OpenAdvisories

Vendor

Casdoor

15 known vulnerabilities.

Products

Casdoor 15
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-9091

    CVE-2026-9091

    Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable…

    Casdoor Casdoor github.com/casdoor/casdoor Go
  • Medium 5.9
    CVE-2026-6815 Public exploit

    CVE-2026-6815

    An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary …

    Casdoor Casdoor github.com/casdoor/casdoor Go
  • Medium 6.1
    CVE-2024-41658

    GHSL-2024-036: Reflected XSS in QrCodePage.js

    Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to generate a WechatPay QR code is vulnerable to reflected XSS. When purchasing an item through casdoor…

    Casdoor Casdoor github.com/casdoor/casdoor Go