CVE-2026-9095: High severity Casdoor Casdoor vulnerability
Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/samlsp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Casdoorto a version that resolves this vulnerability.Fixed in 2.362.0 - Compensating control
Add SAML assertion replay protection in the Casdoor SAML SP code path (e.g., implement assertion ID caching and enforce OneTimeUse/one-time assertion conditions) so ParseSamlResponse() mapping via sp.RetrieveAssertionInfo() cannot be used to replay captured SAML assertions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9095?
The severity of CVE-2026-9095 is high with a CVSS score of 8.1.
What does CVE-2026-9095 affect?
CVE-2026-9095 affects Casdoor versions 2.362.0 and earlier.
How do I fix CVE-2026-9095?
To fix CVE-2026-9095, you should upgrade to a later version of Casdoor that addresses this vulnerability.
What are the potential risks of CVE-2026-9095?
CVE-2026-9095 allows for SAML assertions to be mapped to user sessions without replay protection, leading to potential session hijacking.
What is the impact of CVE-2026-9095 on user data?
CVE-2026-9095 can compromise confidentiality, integrity, and availability of user data due to the lack of security in session mapping.