9.8
Critical
CVE-2026-9097 Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active
Description
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| casdoor 2.362 | earliest → 2.362.0 | No fix stated |
Other CVEs of casdoor
The 15 CVEs of casdoor →
CVE-2026-91998
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with…
9.4
Critical
CVE-2026-90942
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and…
9.3
Critical
CVE-2026-15630
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any…
9.9
Critical
CVE-2026-9098
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed…
9.1
Critical