CVE-2026-9095: CVE-2026-9095

Synopsis

An authentication bypass via SAML assertion replay affects Casdoor versions 2.362.0 and earlier. The vulnerability is reachable over the network and requires no authentication; an attacker who has captured a valid SAML assertion can replay it to obtain an authenticated session for any user, including administrators, bypassing password and MFA checks entirely. HarborGuard is tracking the advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Casdoor SAML SP endpoint over the network, as the attack vector is Network (AV:N).

• AuthenticationNot required

  No credentials are needed before exploitation; the attacker only needs a previously captured SAML assertion (PR:N).

• Victim interactionNot required

  No victim action is required; the attacker submits the replayed assertion directly to the SP endpoint (UI:N).

• Attack complexityDetail

  Attack complexity is High (AC:H), meaning the attacker must first obtain a valid SAML assertion through interception or exfiltration before the replay is possible.

Blast Radius

• Attacker gains an authenticated session for the assertion subject, including any administrator account, without knowing the user's password or MFA secret.
• Full read access to all data visible to the impersonated account, including other users' profiles, access-control rules, and connected application credentials stored in Casdoor.
• Full write access under the impersonated identity, allowing modification of user roles, OAuth client configurations, and identity-provider settings.
• Service integrity is fully compromised: an attacker with replayed admin credentials can disable MFA enforcement, add backdoor accounts, or alter SAML/OIDC provider trust relationships.