VDB
CVE-2026-9093
CVE-2026-9093
PUBLISHED
CVSS 9.8 CRITICAL
Reported by certcc · Published May 28, 2026
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
Risk Scores
CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Casdoor | Casdoor | 0 |
| github.com | casdoor/casdoor | 0 |
| Casdoor | Casdoor | 0, 0, 0 |
Timeline
- May 28, 2026 CVE Published
- May 29, 2026 EPSS Score
- May 30, 2026 EPSS Score
- May 31, 2026 EPSS Score
- May 31, 2026 Coalition ESS Score
- Jun 1, 2026 EPSS Score
- Jun 2, 2026 Security Advisory
- Jun 5, 2026 EPSS Score
- Jul 2, 2026 CVE Updated