In short
- CVE-2026-9093 is a CRITICAL (CVSS 9.8) vulnerability affecting github.com/casdoor/casdoor.
- Chance of exploitation in the next 30 days (EPSS): 0.36%, higher than 30.4% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
| Package | Affected versions | Patched versions |
|---|
| github.com/casdoor/casdoor Go | ≤ 1.1000.1-0.20260321120606-239e8bd69487all versions
| No fix yet |
Description
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
NVD description
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
More vulnerabilities in github.com/casdoor/casdoor
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free