CVE-2026-9095: Casdoor

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.

Affected products

• Casdoor Casdoor: up to and including 2.362.0

Published 2026-05-28. Last modified 2026-06-17.