# CVE-2026-9094: Casdoor cross-organization token exchange privilege escalation

Source: https://junglewise.ai/threats/cve-2026-9094-casdoor-cross-organization-token-exchange-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-9094 · Severity: critical · CVSS 9.8 · Published 2026-05-28

Casdoor is an identity management platform used to control user access and single sign-on for corporate applications. A security flaw in its token exchange system allows a user from one organization to gain access to resources belonging to a completely different organization. This could lead to unauthorized data access or administrative takeover across different business units or clients.

Technologies: [github.com/casdoor/casdoor (Go)](https://junglewise.ai/threats/technologies/github-com-casdoor-casdoor). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-9094 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9094 being exploited in the wild.

**How severe is CVE-2026-9094?** Critical severity, with a CVSS score of 9.8, published 28 May 2026.

**Which products and versions are affected?** github.com/casdoor/casdoor (Go) < 2.387.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.387.0.

**Is there a fix for CVE-2026-9094?** Yes. github.com/casdoor/casdoor (Go): upgrade to 2.387.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9094 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9094?** Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/casdoor/casdoor (Go): upgrade to 2.387.0 or later

  ```sh
  go get github.com/casdoor/casdoor@v2.387.0
  ```


## Technical details

A vulnerability in Casdoor's token exchange mechanism (specifically within the GetTokenExchangeToken function in object/token_oauth.go) allows for cross-organization privilege escalation. While the system correctly validates the cryptographic signature of the incoming JSON Web Token (JWT), it fails to verify that the user associated with the token belongs to the same organization as the target application. An attacker can exploit this lack of organizational boundary enforcement to exchange a valid token from one organization for a token granting access to another. This is tracked as CVE-2026-9094 and was addressed in version 2.387.0.

## Affected products

- Casdoor Casdoor <= 2.362.0

## Identifiers

- CVE-2026-9094
- GHSA-c9w5-qp6m-m395
- GO-2026-5953

## Timeline

- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-07-09: patched

## References

- [https://kb.cert.org/vuls/id/780781](https://kb.cert.org/vuls/id/780781)
- [https://github.com/casdoor/casdoor/commit/d92b8568686d](https://github.com/casdoor/casdoor/commit/d92b8568686d)

## Related threats

- [Casdoor SAML response validation bypass in auth controller](https://junglewise.ai/threats/cve-2026-9098-casdoor-saml-response-validation-bypass-in-auth-controller)
- [Casdoor missing JWT revocation check in token exchange](https://junglewise.ai/threats/cve-2026-9097-casdoor-missing-jwt-revocation-check-in-token-exchange)
- [Casdoor SAML assertion time bound enforcement failure](https://junglewise.ai/threats/cve-2026-9096-casdoor-saml-assertion-time-bound-enforcement-failure)
- [Casdoor SAML audience restriction bypass](https://junglewise.ai/threats/cve-2026-9093-casdoor-saml-audience-restriction-bypass)
- [Casdoor MFA bypass in social-login binding flow](https://junglewise.ai/threats/cve-2026-9091-casdoor-mfa-bypass-in-social-login-binding-flow)