CVE-2026-9092: Critical severity Casdoor Casdoor vulnerability
Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule function matches users by email without checking the emailverified claim from upstream providers; the idp.UserInfo struct does not even include a EmailVerified field. An attacker can supply an unverified email claim from an upstream provider to take over accounts that use the same email address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Casdoorto a version that resolves this vulnerability.Fixed in 2.362.0Patch CVE-2026-9092
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9092?
CVE-2026-9092 has a risk score of 20, indicating a critical vulnerability.
How do I fix CVE-2026-9092?
To fix CVE-2026-9092, upgrade to Casdoor version 2.363.0 or later.
What type of vulnerability is CVE-2026-9092?
CVE-2026-9092 is a vulnerability involving unverified email binding that may enable account takeover.
Who is affected by CVE-2026-9092?
CVE-2026-9092 affects users of Casdoor versions 2.362.0 and earlier.
What can happen if CVE-2026-9092 is exploited?
If exploited, CVE-2026-9092 can lead to unauthorized account access due to account takeover.