Em resumo
- CVE-2026-9093 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta github.com/casdoor/casdoor.
- Chance de exploração nos próximos 30 dias (EPSS): 0.36%, maior que 30.3% das vulnerabilidades.
- Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.
| Package | Affected versions | Patched versions |
|---|
| github.com/casdoor/casdoor Go | ≤ 1.1000.1-0.20260321120606-239e8bd69487all versions
| No fix yet |
Description
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
NVD description
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
Mais vulnerabilidades de github.com/casdoor/casdoor
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free