{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9098", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-05-20T15:05:20.584Z", "datePublished": "2026-05-28T16:31:42.767Z", "dateUpdated": "2026-05-28T16:31:42.767Z"}, "containers": {"cna": {"title": "CVE-2026-9098", "descriptions": [{"lang": "en", "value": "In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Casdoor", "product": "Casdoor", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "2.362.0", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "references": [{"url": "https://kb.cert.org/vuls/id/780781"}], "x_generator": {"engine": "VINCE 3.0.41", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-9098"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-05-28T16:31:42.767Z"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access."}], "id": "CVE-2026-9098", "lastModified": "2026-05-28T18:00:22.543", "metrics": {}, "published": "2026-05-28T17:16:34.963", "references": [{"source": "cret@cert.org", "url": "https://kb.cert.org/vuls/id/780781"}], "sourceIdentifier": "cret@cert.org", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.362.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Casdoor", "source": "cna", "vendor": "Casdoor"}, "product": "casdoor", "vendor": "casdoor"}], "created": "2026-05-28T19:15:06.776524+00:00", "title": "Unsanitized SAML Response Allows Persistent Unauthorized Access in Casdoor", "updated": "2026-05-28T19:30:16.273463+00:00", "vendors": ["casdoor", "casdoor$PRODUCT$casdoor"], "weaknesses": ["CWE-640"]}