Executive brief
Casdoor, an identity management and single sign-on (SSO) platform, contains a security flaw in its login authorization process. An attacker can use this vulnerability to redirect users to malicious websites by tricking them into clicking a specially crafted link. This can be used in phishing campaigns to steal user credentials or distribute malware by making a malicious site appear to be a legitimate part of the organization's infrastructure.
Technical details
An open redirect vulnerability (CWE-601) exists in Casdoor version 2.356.0 within the OAuth Authorization Request Handler component. The application fails to properly validate the 'redirect_uri' parameter during OAuth requests, allowing a remote attacker to supply a malicious URL. If a user interacts with a crafted link, the application will redirect them to the attacker-controlled destination. This vulnerability can be exploited without authentication but requires user interaction. A proof-of-concept exploit is reportedly available publicly. As of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- Casbin Casdoor 2.356.0
Timeline
- 2026-04-03: disclosed: Vulnerability disclosed via VulDB and NVD
- 2026-04-03: advisory: NVD published CVE-2026-5467