VDB
CVE-2026-9096
CVE-2026-9096
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Reported by certcc · Published May 28, 2026
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.
Risk Scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Casdoor | Casdoor | 0 |
| github.com | casdoor/casdoor | 0 |
| Casdoor | Casdoor | 0, 0, 0 |
Timeline
- May 28, 2026 CVE Published
- May 29, 2026 EPSS Score
- May 30, 2026 EPSS Score
- May 31, 2026 EPSS Score
- May 31, 2026 Coalition ESS Score
- Jun 1, 2026 EPSS Score
- Jun 2, 2026 Security Advisory
- Jun 5, 2026 EPSS Score
- Jul 2, 2026 CVE Updated