CVE-2026-9090: CVE-2026-9090

Synopsis

This is an authentication bypass vulnerability in Casdoor versions 2.362.0 and earlier. The flaw is reachable over the network and requires no authentication, because the affected SAML processing function trusts a certificate supplied by the attacker inside the incoming SAMLResponse rather than validating against the pre-configured Identity Provider certificate. Successful exploitation lets an attacker forge SAML assertions and log in as any user, including administrators, giving full read and write access to data the compromised account can reach. HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Casdoor SAML endpoint over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or credential is required; the attacker interacts with the unauthenticated SAML login flow directly.

• Victim interactionNot required

  No user action is needed; the attacker submits a crafted SAMLResponse directly to the service.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions or special environmental factors are required to forge a valid-looking assertion.

Blast Radius

• An attacker can authenticate as any user in the system, including administrators, by forging a SAML assertion signed with an attacker-controlled certificate.
• All data readable by the impersonated account is exposed, including user records, application configurations, and stored credentials managed by Casdoor.
• An attacker with admin-level access can modify user accounts, OAuth client registrations, identity provider configurations, and access control policies.