Loading story…
CERT/CC and independent researchers disclosed multiple critical vulnerabilities in the open-source identity and access management platform Casdoor, affecting version 2.362.0 and earlier. The most severe issue, CVE-2026-9090, stems from improper SAML certificate validation that can let an attacker forge assertions using a self-controlled certificate and log in without valid credentials. Additional flaws, including CVE-2026-9091, can allow multi-factor authentication bypass and exploitation of weak account-binding logic, while CVE-2026-9094 and CVE-2026-9097 create risks of cross-organization token abuse and privilege escalation.
The disclosures warn that the vulnerabilities undermine core authentication and access-management controls in deployments using Casdoor for identity federation and tenant separation. Researchers said no official patch was available at disclosure because they were unable to coordinate with the Casdoor team, and advised defenders to apply manual mitigations such as restricting identity provider integrations, tightening identity governance, enforcing downstream MFA protections, and monitoring for anomalous SAML responses and token-exchange activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed multiple critical vulnerabilities in Casdoor affecting version 2.362.0 and earlier, including CVE-2026-9090, CVE-2026-9091, CVE-2026-9094, and CVE-2026-9097. The disclosure states that no official patch was available at the time because researchers were unable to coordinate with the Casdoor team, and recommends manual mitigations.
CERT/CC published VU#780781 describing multiple authentication bypass and access management vulnerabilities in Casdoor. The advisory identifies the issue set as affecting the product and serves as the public disclosure point in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed **CVE-2026-15243**, an improper certificate validation vulnerability affecting **Apereo CAS Client** software. The issue can undermine trust checks during certificate handling, creating a risk that affected deployments could accept invalid or untrusted certificates and expose authentication-related communications to interception or impersonation scenarios. Public reporting on the flaw identified Apereo CAS Client as the impacted product and linked the disclosure to CERT Polska's advisory. Organizations using the client software should review the vendor and CERT guidance for affected versions, assess where the component is deployed in single sign-on environments, and prioritize remediation or compensating controls to reduce the risk of certificate-based trust bypass.
Jul 25, 2026
Cisco disclosed a critical certificate validation vulnerability in cloud-based **Webex Services** that could let an unauthenticated remote attacker bypass authentication and impersonate legitimate users in environments using single sign-on through **Webex Control Hub**. The flaw, tracked as `CVE-2026-20184` and rated **CVSS 9.8**, stems from improper certificate validation in the SSO implementation (`CWE-295`), which could cause malicious authentication tokens to be accepted as valid. Cisco said it patched the backend cloud service, but affected organizations must also manually upload a new **SAML certificate** for their Identity Provider in Webex Control Hub to fully remediate the issue. The company said there are **no workarounds**, warned that customers who do not update their SAML certificates may remain exposed and could face service disruption, and added that the vulnerability was found during internal security testing with **no known public exploitation** reported at disclosure.
Jun 29, 2026
German government CERT advisories reported a **Keycloak** vulnerability that can allow attackers to bypass security measures in deployments using the identity and access management platform. The issue was published in multiple advisories, indicating continued tracking and notification of the same security weakness affecting Keycloak environments. Organizations using Keycloak should review the affected product versions and vendor guidance tied to the advisories, assess whether authentication or access-control protections could be circumvented, and prioritize remediation. Because Keycloak is commonly used for **single sign-on** and identity federation, a successful bypass could weaken protections around user authentication and protected applications.
Jun 29, 2026