Executive brief
Casdoor, an identity and access management platform, is vulnerable to account takeover due to how it handles third-party logins. When a user signs in via an external provider (like social login), Casdoor fails to verify if the provided email address has actually been verified by that provider. This allows an attacker to create a malicious account on a third-party service with a target's email address and use it to hijack the victim's existing Casdoor account.
Technical details
A vulnerability in Casdoor's account binding logic allows for account takeover via unverified email claims. The 'getExistUserByBindingRule' function matches existing users by email address without validating the 'email_verified' claim from upstream OIDC/OAuth2 identity providers. Furthermore, the 'idp.UserInfo' struct lacks an 'EmailVerified' field entirely, preventing the application from performing this check. An attacker can register an unverified email address at a third-party provider and use it to bind to and take over a Casdoor account sharing that same email address. As of the advisory date, no patch is available.
Affected products
- Casdoor Casdoor 2.362.0 and earlier
Timeline
- 2026-05-28: disclosed: Vulnerability disclosed by CERT/CC after failed coordination with vendor.
- 2026-05-28: advisory