Logic Flaw in Casdoor Products Exposes Users to Bypass MFA Requirements

CVE-2026-9091

What is CVE-2026-9091?

Casdoor versions 2.362.0 and earlier have a critical logic flaw in their social-login binding flow that permits users to circumvent multi-factor authentication (MFA) requirements. The issue arises in the binding-rule code path within the controllers/auth.go file, which directly calls HandleLoggedIn without verifying the MFA settings. Consequently, any user accessing this flow is logged in without undergoing the expected MFA checks, exposing potential risks to user accounts and overall system integrity.

References