Casdoor Social Login Bypass of MFA Enforcement

Executive Summary

This vulnerability exists in Casdoor versions 2.362.0 and earlier. It is a logic flaw in the social-login binding flow that allows users to bypass the configured Multi-Factor Authentication (MFA) requirements.

Specifically, the binding-rule code path in the file controllers/auth.go calls the function HandleLoggedIn directly without invoking the checkMfaEnable function. As a result, any user authenticating via this path is logged in without MFA enforcement.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to bypass Multi-Factor Authentication (MFA) when logging in via the social-login binding flow.

By bypassing MFA, attackers or unauthorized users could gain access to accounts or systems that should have additional security layers, potentially leading to unauthorized access, data breaches, or other security incidents.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Casdoor versions 2.362.0 and earlier allows users to bypass configured multi-factor authentication (MFA) requirements during social-login binding. This bypass weakens the authentication security controls that are often required by standards and regulations such as GDPR and HIPAA to protect user data and ensure strong access controls.

By allowing authentication without enforcing MFA, this flaw could lead to unauthorized access to sensitive personal or health information, potentially resulting in non-compliance with regulations that mandate strong authentication mechanisms to protect data privacy and security.

Useful 0 Not Useful 0