CVE-2026-9092: CVE-2026-9092

Synopsis

An authentication bypass vulnerability in Casdoor (versions 2.362.0 and earlier) allows an attacker to take over existing accounts by supplying an unverified email claim from an upstream identity provider. The vulnerability is reachable over the network and requires no authentication or victim interaction, because the affected getExistUserByBindingRule function matches users by email address without ever checking whether that email was verified by the upstream provider. Successful exploitation gives the attacker full control of any Casdoor account that shares the targeted email address. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Casdoor service over the network; the vulnerable endpoint is exposed via the standard web-facing authentication flow (AV:N).

• AuthenticationNot required

  No account or credentials are needed before exploiting this vulnerability; the attacker interacts as an unauthenticated user presenting a crafted identity-provider response (PR:N).

• Victim interactionNot required

  The attack is fully attacker-driven and does not require any action from a legitimate user or administrator (UI:N).

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, memory layout dependencies, or special environmental factors are required (AC:L).

Blast Radius

• The attacker gains full authenticated access to any Casdoor account whose email address matches the unverified claim, effectively impersonating that account owner.
• All data and resources accessible to the hijacked account become readable by the attacker, including profile data, linked application credentials, and any secrets stored in the account scope.
• The attacker can modify account settings, linked identity providers, and access-control rules tied to the hijacked account, enabling persistent unauthorized changes.