Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
29 results
Oct 11, 2026A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0.CVE-2026-108572 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026A vulnerability was detected in Casdoor up to 3.161.1.CVE-2026-105307 · Other software · reported by VulDBMedium 5.5
A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSeCVE-2026-91998 · Other software · casdoor · reported by VulnCheckCritical 9.4
Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.
- Product
- casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2026Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organizaCVE-2026-90942 · Other software · casdoor · reported by VulnCheckCritical 9.3
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
- Product
- casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026A vulnerability has been found in Casdoor up to 4.0.0.CVE-2026-84423 · Other software · reported by VulDBMedium 5.5
A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch bCVE-2026-15630 · Other software · Casdoor · reported by cret@cert.orgCritical 9.9
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvokecyber.comkb.cert.org
May 28, 2026In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifyinCVE-2026-9098 · Other software · Casdoor · reported by cret@cert.orgCritical 9.1
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active.CVE-2026-9097 · Other software · Casdoor · reported by cret@cert.orgCritical 9.8
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds.CVE-2026-9096 · Other software · Casdoor · reported by cret@cert.orgHigh 7.5
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection.CVE-2026-9095 · Other software · Casdoor · reported by cret@cert.orgHigh 8.1
Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange.CVE-2026-9094 · Other software · Casdoor · reported by cret@cert.orgCritical 9.8
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions.CVE-2026-9093 · Other software · Casdoor · reported by cret@cert.orgCritical 9.8
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover.CVE-2026-9092 · Other software · Casdoor · reported by cret@cert.orgCritical 9.1
Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule function matches users by email without checking the email_verified claim from upstream providers; the idp.UserInfo struct does not even include a EmailVerified field. An attacker can supply an unverified email claim from an upstream provider to take over accounts that use the same email address.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements.CVE-2026-9091 · Other software · Casdoor · reported by cret@cert.orgMedium 5.3
Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate.CVE-2026-9090 · Other software · Casdoor · reported by cret@cert.orgCritical 9.1
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider.CVE-2026-6815 · Other software · Casdoor · reported by cret@cert.orgMedium 5.9
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider. Due to insufficient path sanitization, an authenticated attacker with administrative privileges can perform a Path Traversal attack to create or overwrite arbitrary files anywhere on the host filesystem, bypassing the application's intended storage sandbox.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Apr 3, 2026A weakness has been identified in Casdoor 2.356.0.CVE-2026-5469 · Other software · Casbin · reported by VulDBMedium 5.1
A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026A security flaw has been discovered in Casdoor 2.356.0.CVE-2026-5468 · Other software · Casbin · reported by VulDBLow 2
A security flaw has been discovered in Casdoor 2.356.0. This affects the function dangerouslySetInnerHTML. Performing a manipulation of the argument formCss/formCssMobile/formSideHtml results in cross site scripting. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026A vulnerability was identified in Casdoor 2.356.0.CVE-2026-5467 · Other software · Casbin · reported by VulDBLow 2.1
A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirect_uri leads to open redirect. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2025An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remotCVE-2025-61524 · Other software · reported by MITREHigh 7.2
An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 2, 2025A vulnerability classified as critical was found in Casdoor up to 1.811.0.CVE-2025-4210 · Other software · reported by VulDBMedium 6.9
A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2024Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform.CVE-2024-41658 · Other software · casdoor · reported by GitHubMedium 6.1
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to generate a WechatPay QR code is vulnerable to reflected XSS. When purchasing an item through casdoor, the product page allows you to pay via wechat pay. When using wechat pay, a QR code with the wechat pay link is displayed on the payment page, hosted on the domain of casdoor. This page takes a query parameter from the url successUrl, and redirects the user to that url after a successful purchase. Because the user has no reason to think that the payment page contains sensitive information, they may share it with other or can be social engineered into sending it to others. An attacker can then craft the casdoor link with a special url and send it back to the user, and once payment has gone though an XSS attack occurs.
- Product
- casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Aug 20, 2024Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform.CVE-2024-41657 · Other software · casdoor · reported by GitHubHigh 8.1
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
- Product
- casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecuritylab.github.com
Aug 1, 2024An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.CVE-2024-41264 · Other software · casbin · reported by MITREHigh 7.5
An issue discovered in casdoor v1.636.0 allows attackers to obtain sensitive information via the ssh.InsecureIgnoreHostKey() method.
- Product
- casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2024A vulnerability was found in Casdoor up to 1.335.0.CVE-2024-5587 · Other software · casbin · reported by VulDBMedium 6.9
A vulnerability was found in Casdoor up to 1.335.0. It has been classified as problematic. Affected is an unknown function of the file /conf/app.conf of the component Configuration File Handler. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-266838 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2023Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password.CVE-2023-34927 · Other software · Casbin · reported by MITREMedium 6.5
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcasdoor.orggist.github.com
Dec 6, 2022Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.CVE-2022-44942 · Other software · Casbin · reported by MITREHigh 8.1
Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2022Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.CVE-2022-38638 · Other software · Casbin · reported by MITRECritical 9.1
Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2022The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.CVE-2022-24124 · Other software · Casbin · reported by MITREHigh 7.5
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
- Product
- Casdoor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.