Critical

Authentication bypass in Casdoor SAML callback handling

IdentifiersCVE-2026-9098CWE-294

CVE-2026-9098 affects Casdoor 2.362.0 and earlier. The SAML Assertion Consumer Service callback handler at /api/acs in controllers/auth.go accepts any well-formed SAMLResponse without verifying that the response is tied to an AuthnRequest previously initiated by Casdoor. The handler therefore fails to enforce request-response correlation for SAML authentication flows. In addition, if an administrator disables or deletes an upstream Identity Provider after a SAML flow has begun, Casdoor still processes the response using the provider snapshot loaded at the start of the request. These flaws allow unsolicited SAML responses from a registered upstream IdP, as well as replay of a legitimately captured SAML response in a different session or after the original authentication flow has ended, to be accepted and converted into a valid Casdoor session.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in authentication bypass and unauthorized session issuance. An attacker controlling a registered upstream IdP, or one able to replay a previously captured legitimate SAML response, can cause Casdoor to create a valid authenticated session without a legitimate in-progress login transaction. This can lead to persistent unauthorized access to the affected Casdoor deployment and any applications or resources reachable through that Casdoor-issued session.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by disabling or restricting untrusted upstream IdPs, reviewing and hardening SAML integrations, monitoring /api/acs activity for unsolicited or replayed responses, invalidating suspicious sessions, and limiting external exposure of the /api/acs endpoint where operationally feasible. No complete workaround is provided in the available advisory content.

Remediation

Patch, then assume compromise.

Upgrade Casdoor to a fixed version newer than 2.362.0 that validates SAML responses against a previously issued AuthnRequest and correctly enforces IdP state at callback processing time. Versions 2.362.0 and earlier are affected.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

CasdoorCasdoorapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

1 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity