CVE-2026-9091
Casdoor Social Login Bypass of MFA Enforcement
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: CERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| casdoor | casdoor | to 2.362.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Casdoor versions 2.362.0 and earlier. It is a logic flaw in the social-login binding flow that allows users to bypass the configured Multi-Factor Authentication (MFA) requirements.
Specifically, the binding-rule code path in the file controllers/auth.go calls the function HandleLoggedIn directly without invoking the checkMfaEnable function. As a result, any user authenticating via this path is logged in without MFA enforcement.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized users to bypass Multi-Factor Authentication (MFA) when logging in via the social-login binding flow.
By bypassing MFA, attackers or unauthorized users could gain access to accounts or systems that should have additional security layers, potentially leading to unauthorized access, data breaches, or other security incidents.