CVE-2026-9091: Casdoor MFA bypass in social-login binding flow

CVE-2026-9091 · Severity: medium · CVSS 5.3 · Published 2026-05-28

Casdoor, an identity and access management platform, contains a flaw that allows users to bypass multi-factor authentication (MFA) when logging in via social media accounts. This means that even if an organization requires a second layer of security for its users, an attacker or unauthorized user could gain access to an account using only the primary social login. This undermines the security of the platform and could lead to unauthorized access to sensitive corporate applications and data.

Technologies: github.com/casdoor/casdoor (Go). Vendors: Go.

Quick answers

Is CVE-2026-9091 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9091 being exploited in the wild.
How severe is CVE-2026-9091?
Medium severity, with a CVSS score of 5.3, published 28 May 2026.
Which products and versions are affected?
github.com/casdoor/casdoor (Go) <= 1.1000.1-0.20260321120606-239e8bd69487, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.1-0.20260321120606-239e8bd69487.
Is there a fix for CVE-2026-9091?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9091 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9091?
Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic flaw exists in Casdoor's social-login binding flow within 'controllers/auth.go'. The binding-rule code path incorrectly calls 'HandleLoggedIn' directly without invoking the 'checkMfaEnable' function. This oversight allows any user authenticating through this specific path to bypass multi-factor authentication (MFA) enforcement. The vulnerability is reachable over the network without prior authentication or user interaction. As of the advisory date, no official patch is available from the vendor.

Affected products

  • Casdoor Casdoor <= 2.362.0

Identifiers

  • CVE-2026-9091
  • GHSA-gv4m-v8c8-hr3g
  • GO-2026-5896

Timeline

  • 2026-05-28: advisory: Initial disclosure by CERT/CC and GitHub Advisory Database
  • 2026-05-28: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.