Executive Summary

CVE-2026-9092 is a vulnerability in Casdoor versions 2.362.0 and earlier involving unverified email binding that may enable account takeover.

The vulnerability arises because the function getExistUserByBindingRule matches users by email without verifying the email_verified claim from upstream identity providers.

Moreover, the idp.UserInfo struct does not include an EmailVerified field, which allows an attacker to supply an unverified email claim from an upstream provider to take over accounts that use the same email address.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized account takeover by attackers.

Because the system does not verify whether an email address is verified before binding it to a user account, an attacker can supply an unverified email claim to gain access to accounts associated with that email.

This bypasses email verification controls and facilitates unauthorized access to user accounts, potentially compromising sensitive information and user data.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Casdoor allows attackers to take over user accounts by exploiting unverified email binding, which bypasses email verification controls.

This unauthorized access risk can lead to violations of common standards and regulations such as GDPR and HIPAA, which require strict controls on user identity verification and protection of personal data.

By enabling account takeover through unverified email claims, the vulnerability undermines the integrity and confidentiality of user data, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the application verifies the email_verified claim from upstream identity providers before binding email addresses to user accounts.

Since the idp.UserInfo struct lacks an EmailVerified field, update or patch Casdoor to a version that includes proper verification of email claims or implement additional checks to confirm email verification status.

Avoid accepting unverified email claims from upstream providers to prevent attackers from taking over accounts using the same email address.

Useful 0 Not Useful 0