Executive brief
Casdoor is an identity management platform used to control user access and single sign-on for corporate applications. A security flaw in its token exchange system allows a user from one organization to gain access to resources belonging to a completely different organization. This could lead to unauthorized data access or administrative takeover across different business units or clients.
Technical details
A vulnerability in Casdoor's token exchange mechanism (specifically within the GetTokenExchangeToken function in object/token_oauth.go) allows for cross-organization privilege escalation. While the system correctly validates the cryptographic signature of the incoming JSON Web Token (JWT), it fails to verify that the user associated with the token belongs to the same organization as the target application. An attacker can exploit this lack of organizational boundary enforcement to exchange a valid token from one organization for a token granting access to another. This is tracked as CVE-2026-9094 and was addressed in version 2.387.0.
Affected products
- Casdoor Casdoor <= 2.362.0
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-07-09: patched