CVE-2026-9094 CVE-2026-9094
Attackers can exchange tokens across organizations due to missing user validation, leading to privilege escalation in Casdoor identity provider.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-9094?
CVE-2026-9094 is a critical authentication bypass vulnerability in Casdoor, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
Which versions are affected by CVE-2026-9094?
3 open source packages ship an affected version, including github.com/casdoor/casdoor.
| Package | Affected | Fixed in |
|---|---|---|
github.com/casdoor/casdoor Go | All versions | None |
github.com/casdoor/casdoor Go | All versions | 2.387.0 |
github.com/casdoor/casdoor Go | All versions | 2.387.0 |
How do I fix CVE-2026-9094?
Upgrade github.com/casdoor/casdoor to 2.387.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-9094 being exploited?
There is no known exploitation of CVE-2026-9094 in the wild and no public exploit code.
Sources
Also known as GHSA-c9w5-qp6m-m395, GO-2026-5953.