CVE-2026-9093 CVE-2026-9093
Casdoor fails to validate SAML AudienceRestriction, allowing attackers to use assertions from other providers to bypass authentication and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9093?
CVE-2026-9093 is a critical authentication bypass vulnerability in Casdoor, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
Which versions are affected by CVE-2026-9093?
3 open source packages ship an affected version, including github.com/casdoor/casdoor.
| Package | Affected | Fixed in |
|---|---|---|
github.com/casdoor/casdoor Go | All versions | None |
github.com/casdoor/casdoor Go | All versions to 1.1000.1-0.20260321120606-239e8bd69487 | None |
github.com/casdoor/casdoor Go | All versions to 1.1000.1-0.20260321120606-239e8bd69487 | None |
How do I fix CVE-2026-9093?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-9093 being exploited?
There is no known exploitation of CVE-2026-9093 in the wild and no public exploit code.
Sources
Also known as GHSA-3w4h-g9f5-j84p, GO-2026-5894.