Loading vulnerability…
Casdoor 2.362.0 and earlier contain an authentication bypass vulnerability in SAML assertion verification. According to the provided content, the vulnerable buildSpCertificateStore function extracts the X.509 signing certificate directly from the incoming SAMLResponse rather than validating the assertion against the trusted, pre-configured Identity Provider certificate. This allows an attacker to supply an arbitrary certificate and corresponding private key, sign forged SAML assertions, and have those assertions accepted as valid by the application.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small, single-script Python proof-of-concept exploit for CVE-2026-9090 affecting Casdoor SAML service-provider certificate validation. The repo contains 3 files: the main exploit script (CVE-2026-9090.py), a short README describing the vulnerability and usage, and requirements.txt listing lxml, signxml, and cryptography. The exploit is not framework-based. Its core capability is SAML authentication forgery: it generates an attacker-controlled RSA keypair and self-signed X.509 certificate, constructs a SAML 2.0 assertion for the user 'admin', signs it with XML-DSig, and relies on the vulnerable Casdoor behavior of trusting the signing certificate embedded in the incoming SAMLResponse instead of validating against the configured IdP certificate. This allows arbitrary assertion signing and impersonation. Operational flow in the script: (1) initialize target base URL from CASDOOR_URL, defaulting to http://127.0.0.1:9350; (2) generate a self-signed certificate; (3) build a forged SAML assertion with issuer https://idp.aerobook.internal/saml/metadata, recipient CASDOOR/api/acs, audience CASDOOR, and admin identity attributes; (4) sign the assertion using signxml with enveloped RSA-SHA256 XML signatures; (5) wrap it in a SAMLResponse; (6) submit it through the ACS/login flow, capture a redirect containing samlResponse, then POST JSON to /api/login with hardcoded provider/application/organization values; and (7) if login succeeds, reuse the authenticated cookie jar to query /api/get-providers?owner=admin as a privilege check / loot step. The exploit is more than a detector and includes a working payload path, but it is still a straightforward PoC/operational script rather than a highly modular weaponized tool. Hardcoded values such as provider='corp-idp', application='app-built-in', organization='built-in', and the forged admin attributes indicate it is tailored to a specific Casdoor SAML configuration or lab environment. The main fingerprintable targets are the Casdoor base URL and API endpoints /api/acs, /api/login, and /api/get-providers?owner=admin, plus the forged issuer URL embedded in the assertion.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.