VDB
CVE-2026-9094
CVE-2026-9094
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Reported by certcc · Published May 28, 2026
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Casdoor | Casdoor | 0 |
| github.com | casdoor/casdoor | 0 |
| Casdoor | Casdoor | 0, 0, 0 |
Timeline
- May 28, 2026 CVE Published
- May 29, 2026 EPSS Score
- May 30, 2026 EPSS Score
- May 31, 2026 EPSS Score
- May 31, 2026 Coalition ESS Score
- Jun 1, 2026 EPSS Score
- Jun 2, 2026 Security Advisory
- Jun 2, 2026 CVE Updated
- Jun 5, 2026 EPSS Score