CVE-2026-9096: High severity Casdoor Casdoor vulnerability
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Casdoorto a version that resolves this vulnerability.Fixed in 2.362.0 - Configuration
Update the SAML response handling so that ParseSamlResponse() failures/warnings reported in assertionInfo.WarningInfo for NotOnOrAfter and NotBefore are enforced when issuing the user session (instead of silently discarding time-bound validation results).
gosaml2 / Casdoor SAML handling ParseSamlResponse() assertionInfo.WarningInfo handling = Treat NotOnOrAfter and NotBefore validation results as authoritative (do not ignore assertionInfo.WarningInfo)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9096?
CVE-2026-9096 has a risk rating of 20, indicating a critical vulnerability.
How do I fix CVE-2026-9096?
To fix CVE-2026-9096, upgrade to Casdoor versions later than 2.362.0 that properly enforce SAML assertion time bounds.
What software is affected by CVE-2026-9096?
CVE-2026-9096 affects Casdoor versions 2.362.0 and earlier.
What protections are bypassed in CVE-2026-9096?
CVE-2026-9096 allows attackers to bypass SAML assertion time validation due to the implementation error in ParseSamlResponse().
What is the potential impact of CVE-2026-9096?
The potential impact of CVE-2026-9096 includes unauthorized access or exploitation due to improperly validated SAML assertions.