Is CVE-2026-9094 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9094 being exploited in the wild.

How severe is CVE-2026-9094?

Critical severity, with a CVSS score of 9.8, published 28 May 2026.

Which products and versions are affected?

github.com/casdoor/casdoor (Go) < 2.387.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.387.0.

Is there a fix for CVE-2026-9094?

Yes. github.com/casdoor/casdoor (Go): upgrade to 2.387.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9094 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9094?

Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9094: Casdoor cross-organization token exchange privilege escalation

Q: Is there a fix for CVE-2026-9094?

Yes. github.com/casdoor/casdoor (Go): upgrade to 2.387.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-9094 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-9094?

Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9094 · Severity: critical · CVSS 9.8 · Published 2026-05-28

Casdoor is an identity management platform used to control user access and single sign-on for corporate applications. A security flaw in its token exchange system allows a user from one organization to gain access to resources belonging to a completely different organization. This could lead to unauthorized data access or administrative takeover across different business units or clients.

Technologies: github.com/casdoor/casdoor (Go). Vendors: Go.

Quick answers

Is CVE-2026-9094 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9094 being exploited in the wild.
How severe is CVE-2026-9094?: Critical severity, with a CVSS score of 9.8, published 28 May 2026.
Which products and versions are affected?: github.com/casdoor/casdoor (Go) < 2.387.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.387.0.
Is there a fix for CVE-2026-9094?: Yes. github.com/casdoor/casdoor (Go): upgrade to 2.387.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9094 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9094?: Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/casdoor/casdoor (Go): upgrade to 2.387.0 or later
```
go get github.com/casdoor/casdoor@v2.387.0
```

Technical details

A vulnerability in Casdoor's token exchange mechanism (specifically within the GetTokenExchangeToken function in object/token_oauth.go) allows for cross-organization privilege escalation. While the system correctly validates the cryptographic signature of the incoming JSON Web Token (JWT), it fails to verify that the user associated with the token belongs to the same organization as the target application. An attacker can exploit this lack of organizational boundary enforcement to exchange a valid token from one organization for a token granting access to another. This is tracked as CVE-2026-9094 and was addressed in version 2.387.0.

Affected products

Casdoor Casdoor <= 2.362.0

Identifiers

CVE-2026-9094
GHSA-c9w5-qp6m-m395
GO-2026-5953

Timeline

2026-05-28: disclosed
2026-05-28: advisory
2026-07-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.