Is CVE-2026-9092 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9092 being exploited in the wild.

How severe is CVE-2026-9092?

Informational severity, with a CVSS score of 8.1, published 28 May 2026.

Which products and versions are affected?

Casdoor Casdoor 2.362.0 and earlier.

Is there a fix for CVE-2026-9092?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9092 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-9092?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9092: Casdoor account takeover via unverified email binding

CVE-2026-9092 · Severity: info · CVSS 8.1 · Published 2026-05-28

Casdoor, an identity and access management platform, is vulnerable to account takeover due to how it handles third-party logins. When a user signs in via an external provider (like social login), Casdoor fails to verify if the provided email address has actually been verified by that provider. This allows an attacker to create a malicious account on a third-party service with a target's email address and use it to hijack the victim's existing Casdoor account.

Quick answers

Is CVE-2026-9092 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9092 being exploited in the wild.
How severe is CVE-2026-9092?: Informational severity, with a CVSS score of 8.1, published 28 May 2026.
Which products and versions are affected?: Casdoor Casdoor 2.362.0 and earlier.
Is there a fix for CVE-2026-9092?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9092 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9092?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Casdoor's account binding logic allows for account takeover via unverified email claims. The 'getExistUserByBindingRule' function matches existing users by email address without validating the 'email_verified' claim from upstream OIDC/OAuth2 identity providers. Furthermore, the 'idp.UserInfo' struct lacks an 'EmailVerified' field entirely, preventing the application from performing this check. An attacker can register an unverified email address at a third-party provider and use it to bind to and take over a Casdoor account sharing that same email address. As of the advisory date, no patch is available.

Affected products

Casdoor Casdoor 2.362.0 and earlier

Timeline

2026-05-28: disclosed: Vulnerability disclosed by CERT/CC after failed coordination with vendor.
2026-05-28: advisory

References

https://kb.cert.org/vuls/id/780781

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.