CVE-2026-9096: CVE-2026-9096

Synopsis

This is an authentication bypass vulnerability in Casdoor, an open-source identity and access management server, affecting versions 2.362.0 and earlier. The flaw is reachable over the network with no credentials or user interaction required. A remote, unauthenticated attacker can replay expired or not-yet-valid SAML assertions to create arbitrary user sessions, bypassing time-based replay protection entirely. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Casdoor SAML endpoint over the network; no local or physical access is required.

• AuthenticationNot required

  No credentials are needed; the attacker submits a crafted or replayed SAML assertion without any prior login.

• Victim interactionNot required

  The attack targets the server-side SAML response parser directly and requires no action from another user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs a valid (or previously valid) SAML assertion, with no race conditions or environmental constraints.

Blast Radius

• An attacker replays an expired or future-dated SAML assertion and obtains a fully authenticated session for any identity asserted in that token, including administrator accounts.
• Depending on the role encoded in the replayed assertion, the attacker can read, modify, or delete user records, OAuth clients, and identity-provider configurations stored in Casdoor.
• A compromised Casdoor instance acts as an upstream identity provider for downstream applications, so session hijacking here propagates access across every service that trusts Casdoor for authentication.