VDB

CVE-2026-9094

CVE-2026-9094 PUBLISHED CVSS 9.300000190734863 CRITICAL

Reported by certcc · Published May 28, 2026

Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.

Risk Scores

CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
CasdoorCasdoor0
github.comcasdoor/casdoor0
CasdoorCasdoor0, 0, 0

Timeline

  • May 28, 2026 CVE Published
  • May 29, 2026 EPSS Score
  • May 30, 2026 EPSS Score
  • May 31, 2026 EPSS Score
  • May 31, 2026 Coalition ESS Score
  • Jun 1, 2026 EPSS Score
  • Jun 2, 2026 Security Advisory
  • Jun 2, 2026 CVE Updated
  • Jun 5, 2026 EPSS Score
Open in Interactive Console →
$ Console Community · 100/wk Open console ›