Authentication Bypass Vulnerability in Casdoor by Authing

CVE-2026-9090

What is CVE-2026-9090?

Casdoor prior to version 2.362.0 is susceptible to an authentication bypass vulnerability. An attacker can exploit this weakness by supplying an arbitrary signing certificate, bypassing the security checks. The flawed buildSpCertificateStore function retrieves the X.509 certificate directly from the incoming SAMLResponse instead of relying on the pre-configured Identity Provider certificate. This oversight allows attackers to forge assertions signed with keys they control, posing a significant threat to system integrity and security. It is crucial for users to upgrade to the latest version to mitigate this risk.

References