Executive brief
Casdoor, an open-source identity and access management platform, fails to check if security tokens have been revoked during certain exchange processes. This allows an attacker with a stolen or previously invalidated token to continue accessing the system as if the token were still valid. Consequently, administrators cannot effectively terminate suspicious sessions or revoke access for compromised accounts, leading to persistent unauthorized access.
Technical details
A vulnerability exists in Casdoor's token exchange mechanism within the GetTokenExchangeToken() function in object/token_oauth.go. While the application validates the JWT signature and parses claims, it fails to query the backend Token table to verify if the subject token is still active or has been revoked. This lack of a revocation check allows an attacker to use a compromised or administratively invalidated token to obtain new tokens. The attack is reachable over the network without authentication or user interaction, leading to a complete breakdown of session management and revocation controls. As of the advisory date, no patch is available.
Affected products
- Casdoor Casdoor <= 2.362.0
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory