Executive brief
Casdoor, an open-source identity and access management platform, contains a security vulnerability that allows for cross-site scripting (XSS). An attacker can exploit this by injecting malicious code into specific form configuration fields, which then executes in the browser of other users. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in Casdoor 2.356.0 due to the unsafe use of the dangerouslySetInnerHTML function in the frontend. The vulnerability is triggered by manipulating the formCss, formCssMobile, or formSideHtml arguments, which lack proper input sanitization. An attacker with low-level privileges can initiate this attack remotely, though it requires some user interaction (UI:R). Successful exploitation allows the execution of arbitrary script code in the context of the victim's session. While the vendor was notified, no official patch has been confirmed at the time of disclosure, and public exploit code is reportedly available.
Affected products
- Casbin Casdoor 2.356.0
Timeline
- 2026-04-03: disclosed: Vulnerability disclosed and CVE assigned via VulDB
- 2026-04-03: advisory: NVD published the advisory