CVE-2026-9094: Critical severity Casdoor Casdoor vulnerability
Published May 28, 2026
·Updated
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/tokenoauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
Affected Software
1 affected component
Casdoor Casdoor<=2.362.0
Event History
May 28, 2026
CVE Published
via MITRE·04:25 PM
Data Sourced
via MITRE·04:25 PM
DescriptionWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverity
Apr 27, 58520
Event
via FIRST·11:49 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-9094?
CVE-2026-9094 has a risk rating of 20, indicating a critical severity.
2
How do I fix CVE-2026-9094?
To fix CVE-2026-9094, upgrade to Casdoor version 2.363.0 or later.
3
What software is affected by CVE-2026-9094?
CVE-2026-9094 affects Casdoor versions 2.362.0 and earlier.
4
What type of vulnerability is CVE-2026-9094?
CVE-2026-9094 is a cross-organization token exchange vulnerability.
5
What function is responsible for the vulnerability in CVE-2026-9094?
The GetTokenExchangeToken function in object/token_oauth.go is responsible for the vulnerability.