CVE-2026-9093: CVE-2026-9093

Synopsis

This is an authentication bypass vulnerability in Casdoor, an open-source identity and access management server. The flaw is reachable over the network without any credentials and requires no user interaction, as derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N). An attacker who can obtain or forge a SAML assertion issued for any other service provider can present it to Casdoor and be accepted as a valid authenticated user, enabling full account takeover and access to protected resources. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable SAML endpoint is exposed over the network, so an attacker must be able to reach the Casdoor service via HTTP/HTTPS from a remote origin.

• AuthenticationNot required

  No credentials are required; the attacker supplies a SAML assertion in the place of legitimate authentication, bypassing the credential check entirely.

• Victim interactionNot required

  No victim action is needed; the attacker sends a crafted SAML assertion directly to the service provider endpoint without any user involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free once the attacker possesses or can forge a SAML assertion from any other service provider.

Blast Radius

• A successful attacker is accepted as an authenticated user in Casdoor, gaining read access to all identity data, stored credentials, and user records managed by the instance.
• The attacker can modify user accounts, roles, and access policies, effectively controlling downstream applications that rely on Casdoor for authentication.
• The attacker can delete or corrupt identity records and configurations, causing denial of authentication services for legitimate users across integrated applications.