CVE-2026-9098: CVE-2026-9098

Synopsis

This is an authentication bypass vulnerability in Casdoor, an open-source identity and access management server, affecting versions 2.362.0 and earlier. The SAML callback handler accepts any well-formed SAML response sent over the network without verifying it was requested by Casdoor, and it also continues processing responses tied to identity providers that have since been disabled or deleted. An attacker who controls a registered upstream identity provider, or who has captured a legitimate SAML response, can send unsolicited or replayed responses and receive a valid Casdoor session, gaining persistent unauthorized access without any credentials. HarborGuard is tracking the advisory for patch availability and will make a patched rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Casdoor SAML callback endpoint (/api/acs) over the network; no local access or physical proximity is needed.

• AuthenticationNot required

  No account or credentials on the Casdoor instance are required; the attacker only needs to be able to send a well-formed SAMLResponse to the public endpoint.

• Victim interactionNot required

  No user action is needed; the attacker sends the unsolicited or replayed SAML response directly to the handler without involving any victim.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: the attacker simply needs a registered upstream IdP or a captured SAML response, with no race conditions or special memory layout required.

Blast Radius

• Reads session tokens issued by Casdoor and any data accessible to the hijacked identity, including user profiles and directory information managed by the identity server.
• Modifies account settings, role assignments, or linked application permissions for the session identity, depending on that identity's privilege level within Casdoor.
• Establishes persistent unauthorized access by retaining the issued session, allowing repeated access without re-exploiting the flaw until the session is explicitly revoked.
• Enables lateral movement into any application or service that trusts Casdoor as its identity provider, since the issued session carries the full claims of the impersonated identity.