Is CVE-2026-5467 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5467 being exploited in the wild.

How severe is CVE-2026-5467?

Medium severity, with a CVSS score of 4.3, published 3 April 2026.

Which products and versions are affected?

Casbin Casdoor <= 1.1000.0, 2.356.0; github.com/casdoor/casdoor (Go) <= 1.1000.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.0.

Is there a fix for CVE-2026-5467?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5467 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5467?

Check whether you run Casbin Casdoor or github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5467: Casbin Casdoor open redirect in OAuth Authorization Request Handler

Q: Which products and versions are affected?

Casbin Casdoor <= 1.1000.0, 2.356.0; github.com/casdoor/casdoor (Go) <= 1.1000.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.0.

Q: Is there a fix for CVE-2026-5467?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-5467 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-5467?

Check whether you run Casbin Casdoor or github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5467 · Severity: medium · CVSS 4.3 · Published 2026-04-03

Casdoor, an identity management and single sign-on (SSO) platform, contains a security flaw in its login authorization process. An attacker can use this vulnerability to redirect users to malicious websites by tricking them into clicking a specially crafted link. This can be used in phishing campaigns to steal user credentials or distribute malware by making a malicious site appear to be a legitimate part of the organization's infrastructure.

Technologies: Casbin Casdoor, github.com/casdoor/casdoor (Go). Vendors: Casbin, Go.

Quick answers

Is CVE-2026-5467 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5467 being exploited in the wild.
How severe is CVE-2026-5467?: Medium severity, with a CVSS score of 4.3, published 3 April 2026.
Which products and versions are affected?: Casbin Casdoor <= 1.1000.0, 2.356.0; github.com/casdoor/casdoor (Go) <= 1.1000.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.0.
Is there a fix for CVE-2026-5467?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5467 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5467?: Check whether you run Casbin Casdoor or github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in Casdoor version 2.356.0 within the OAuth Authorization Request Handler component. The application fails to properly validate the 'redirect_uri' parameter during OAuth requests, allowing a remote attacker to supply a malicious URL. If a user interacts with a crafted link, the application will redirect them to the attacker-controlled destination. This vulnerability can be exploited without authentication but requires user interaction. A proof-of-concept exploit is reportedly available publicly. As of the advisory date, the vendor has not responded to disclosure attempts.

Affected products

Casbin Casdoor 2.356.0

Identifiers

CVE-2026-5467
GHSA-mj24-pqx2-6788
GO-2026-5509

Timeline

2026-04-03: disclosed: Vulnerability disclosed via VulDB and NVD
2026-04-03: advisory: NVD published CVE-2026-5467

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.