CVE-2026-91998 | Critical | 9.9 | 2026-09-15 | Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientS… |
CVE-2026-90942 | Critical | 9.6 | 2026-09-14 | Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organiz… |
CVE-2026-15630 | Critical | 9.9 | 2026-07-23 | A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch… |
CVE-2026-9098 | Critical | 9.1 | 2026-05-28 | In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifyi… |
CVE-2026-9097 | Critical | 9.8 | 2026-05-28 | Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oau… |
CVE-2026-9096 | High | 7.5 | 2026-05-28 | Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter… |
CVE-2026-9095 | High | 8.1 | 2026-05-28 | Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go call… |
CVE-2026-9094 | Critical | 9.8 | 2026-05-28 | Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oau… |
CVE-2026-9093 | Critical | 9.8 | 2026-05-28 | In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The bui… |
CVE-2026-9092 | Critical | 9.1 | 2026-05-28 | Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule… |
CVE-2026-9091 | Medium | 5.3 | 2026-05-28 | Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding… |
CVE-2026-9090 | Critical | 9.1 | 2026-05-28 | Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. Th… |
CVE-2026-6815 | Medium | 5.9 | 2026-05-11 | An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker… |
CVE-2024-41658 | Medium | 6.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to… |
CVE-2024-41657 | High | 8.1 | 2024-08-20 | Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the… |