Executive brief
Casdoor, an identity and access management platform, fails to check the expiration time of security tokens used during login. This allows an attacker to reuse old or expired login credentials to gain unauthorized access to the system. Because these time limits are ignored, a session could remain valid indefinitely, potentially leading to long-term unauthorized access to sensitive corporate data and applications.
Technical details
Casdoor versions 2.362.0 and earlier contain a vulnerability where SAML assertion time bounds (NotOnOrAfter and NotBefore) are not enforced. While the underlying 'gosaml2' library performs these checks and populates the 'assertionInfo.WarningInfo' field with the results, the 'ParseSamlResponse()' function in Casdoor's 'object/saml_sp.go' fails to inspect this field. Consequently, expired or premature assertions are accepted as valid, allowing for session issuance regardless of the assertion's intended validity period. This is a network-reachable vulnerability requiring no prior authentication or user interaction. As of the advisory date, no patch is available.
Affected products
- Casdoor Casdoor <= 2.362.0
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory