Executive brief
Casdoor, an identity and access management platform, contains a flaw that allows users to bypass multi-factor authentication (MFA) when logging in via social media accounts. This means that even if an organization requires a second layer of security for its users, an attacker or unauthorized user could gain access to an account using only the primary social login. This undermines the security of the platform and could lead to unauthorized access to sensitive corporate applications and data.
Technical details
A logic flaw exists in Casdoor's social-login binding flow within 'controllers/auth.go'. The binding-rule code path incorrectly calls 'HandleLoggedIn' directly without invoking the 'checkMfaEnable' function. This oversight allows any user authenticating through this specific path to bypass multi-factor authentication (MFA) enforcement. The vulnerability is reachable over the network without prior authentication or user interaction. As of the advisory date, no official patch is available from the vendor.
Affected products
- Casdoor Casdoor <= 2.362.0
Timeline
- 2026-05-28: advisory: Initial disclosure by CERT/CC and GitHub Advisory Database
- 2026-05-28: disclosed: NVD publication date