Casdoor doesn't enforce SAML assertion time bounds

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-9096 · ADVISORY
• casdoor/casdoor · PACKAGE
• kb.cert.org/vuls/id/780781 · WEB
• GitHub Advisory GHSA-rgq2-93gj-ffxg · ADVISORY

github.com/casdoor/casdoor のその他の脆弱性

• CVE-2026-9098緊急 9.1In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/…
• CVE-2026-9097緊急 9.8Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function …
• CVE-2026-9094緊急 9.8Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function …
• CVE-2026-9093緊急 9.8In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML …
• CVE-2026-9091中 5.3Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requir…