9.3
Critical
CVE-2026-90942 Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and…
Description
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| casdoor 4.4 | earliest → 4.4.0 | No fix stated |
Other CVEs of casdoor
The 15 CVEs of casdoor →
CVE-2026-91998
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with…
9.4
Critical
CVE-2026-15630
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any…
9.9
Critical
CVE-2026-9098
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed…
9.1
Critical
CVE-2026-9097
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active
9.8
Critical