Back to overview

CVE-2026-9095

HIGH
8.1
CVSS 3.1
Description
Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.

Metadata

CVE ID
CVE-2026-9095
State
PUBLISHED
Assigner
certcc
Reserved
2026-05-20 15:04 UTC
Published
2026-05-28 16:25 UTC
Last updated
2026-05-28 17:07 UTC
Primary CWE
CWE-294
CWE-294 Authentication Bypass by Capture-replay
Vendor / Product
Casdoor / Casdoor
Sources
cve.org  ·  NVD

Severity & Metrics

8.1 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Casdoor Casdoor — 0 ≤ 2.362.0
Weakness (CWE)
CWESourceDescription
— cna CWE-294 Authentication Bypass by Capture-replay
CWE-294 adp CWE-294 Authentication Bypass by Capture-replay
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.1 HIGH 3.1 adp CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References (1)
Back to overview