CVE-2026-9097: Casdoor missing JWT revocation check in token exchange

CVE-2026-9097 · Severity: critical · CVSS 9.8 · Published 2026-05-28

Casdoor, an open-source identity and access management platform, fails to check if security tokens have been revoked during certain exchange processes. This allows an attacker with a stolen or previously invalidated token to continue accessing the system as if the token were still valid. Consequently, administrators cannot effectively terminate suspicious sessions or revoke access for compromised accounts, leading to persistent unauthorized access.

Technologies: github.com/casdoor/casdoor (Go). Vendors: Go.

Quick answers

Is CVE-2026-9097 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-9097 being exploited in the wild.
How severe is CVE-2026-9097?
Critical severity, with a CVSS score of 9.8, published 28 May 2026.
Which products and versions are affected?
github.com/casdoor/casdoor (Go) <= 1.1000.1-0.20260321120606-239e8bd69487, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.1000.1-0.20260321120606-239e8bd69487.
Is there a fix for CVE-2026-9097?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9097 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9097?
Check whether you run github.com/casdoor/casdoor (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Casdoor's token exchange mechanism within the GetTokenExchangeToken() function in object/token_oauth.go. While the application validates the JWT signature and parses claims, it fails to query the backend Token table to verify if the subject token is still active or has been revoked. This lack of a revocation check allows an attacker to use a compromised or administratively invalidated token to obtain new tokens. The attack is reachable over the network without authentication or user interaction, leading to a complete breakdown of session management and revocation controls. As of the advisory date, no patch is available.

Affected products

  • Casdoor Casdoor <= 2.362.0

Identifiers

  • CVE-2026-9097
  • GHSA-339w-3hqm-9pjc
  • GO-2026-5892

Timeline

  • 2026-05-28: disclosed
  • 2026-05-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.