# CVE-2026-9090: Casdoor SAML authentication bypass via arbitrary signing certificate

Source: https://junglewise.ai/threats/cve-2026-9090-casdoor-saml-authentication-bypass-via-arbitrary-signing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-9090 · Severity: critical · CVSS 9.1 · Published 2026-05-28

Casdoor, an open-source identity and access management platform, contains a critical security flaw in how it handles login requests. An attacker can bypass the authentication process by providing a fake security certificate, allowing them to log in as any user, including administrators, without a password. This could lead to a total compromise of the identity system and unauthorized access to all connected applications and customer data.

Technologies: [github.com/casdoor/casdoor (Go)](https://junglewise.ai/threats/technologies/github-com-casdoor-casdoor). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-9090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9090 being exploited in the wild.

**How severe is CVE-2026-9090?** Critical severity, with a CVSS score of 9.1, published 28 May 2026.

**Which products and versions are affected?** github.com/casdoor/casdoor (Go) <= 1.1000.1-0.20260321120606-239e8bd69487, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.1-0.20260321120606-239e8bd69487.

**Is there a fix for CVE-2026-9090?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9090 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9090?** Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in Casdoor's SAML service provider implementation. The 'buildSpCertificateStore' function improperly extracts X.509 certificates directly from incoming SAMLResponse messages rather than validating them against a pre-configured, trusted Identity Provider (IdP) certificate. A remote, unauthenticated attacker can exploit this by crafting a SAML assertion signed with an arbitrary, attacker-controlled key. Successful exploitation allows the attacker to impersonate any user subject within the system. As of the advisory date, no official patch is available.

## Affected products

- Casdoor Casdoor <= 2.362.0

## Identifiers

- CVE-2026-9090
- GHSA-fwgq-j9r9-qjgr
- GO-2026-5895

## Timeline

- 2026-05-28: advisory: Original release date of VU#780781 and GHSA-fwgq-j9r9-qjgr
- 2026-05-28: disclosed: CVE-2026-9090 published

## References

- [https://kb.cert.org/vuls/id/780781](https://kb.cert.org/vuls/id/780781)

## Related threats

- [Casdoor SAML response validation bypass in auth controller](https://junglewise.ai/threats/cve-2026-9098-casdoor-saml-response-validation-bypass-in-auth-controller)
- [Casdoor missing JWT revocation check in token exchange](https://junglewise.ai/threats/cve-2026-9097-casdoor-missing-jwt-revocation-check-in-token-exchange)
- [Casdoor SAML assertion time bound enforcement failure](https://junglewise.ai/threats/cve-2026-9096-casdoor-saml-assertion-time-bound-enforcement-failure)
- [Casdoor cross-organization token exchange privilege escalation](https://junglewise.ai/threats/cve-2026-9094-casdoor-cross-organization-token-exchange-privilege-escalation)
- [Casdoor SAML audience restriction bypass](https://junglewise.ai/threats/cve-2026-9093-casdoor-saml-audience-restriction-bypass)