CVE-2026-9091: Casdoor

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.

Affected products

• Casdoor Casdoor: up to and including 2.362.0

Published 2026-05-28. Last modified 2026-06-17.