CVE-2026-9091 CVE-2026-9091
Attackers can bypass Multi-Factor Authentication requirements by exploiting a logic flaw in the social-login binding flow of Casdoor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9091?
CVE-2026-9091 is a medium-severity vulnerability in Casdoor, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.
Which versions are affected by CVE-2026-9091?
3 open source packages ship an affected version, including github.com/casdoor/casdoor.
| Package | Affected | Fixed in |
|---|---|---|
github.com/casdoor/casdoor Go | All versions | None |
github.com/casdoor/casdoor Go | All versions to 1.1000.1-0.20260321120606-239e8bd69487 | None |
github.com/casdoor/casdoor Go | All versions to 1.1000.1-0.20260321120606-239e8bd69487 | None |
How do I fix CVE-2026-9091?
Upgrade to a fixed version.
Is CVE-2026-9091 being exploited?
There is no known exploitation of CVE-2026-9091 in the wild and no public exploit code.
Sources
Also known as GHSA-gv4m-v8c8-hr3g, GO-2026-5896.