CVE-2026-90942: Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An organization administrator can exploit it by accessing the certificate endpoints that expose the instance-wide built-in certificate private key. No user interaction is required.
What is the impact of obtaining the exposed key?
The private key can be used to forge JWT tokens for any user in any organization on the instance. This includes forging tokens for global administrators, enabling cross-organization privilege escalation.
Which deployments are affected?
Casdoor versions through 4.4.0 are affected when the instance-wide built-in certificate private key is available through the /api/get-certs or /api/get-cert endpoints.
How can I determine whether the instance is exposed?
Review access to /api/get-certs and /api/get-cert as an organization administrator and verify whether either endpoint returns the instance-wide built-in certificate private key. If it does, assume the key may be usable for JWT forgery.