CVE-2026-9093

Deferred Deferred - Pending Action

SAML AudienceRestriction Validation Flaw in Casdoor

Publication date: 2026-05-28

Last updated on: 2026-06-02

Assigner: CERT/CC

Description

In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-02

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-9093

EUVD

EUVD-2026-32945

Affected Vendors & Products

Vendor	Product	Version / Range
casdoor	casdoor	to 2.362.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in Casdoor versions 2.362.0 and earlier, where the SAML service provider implementation does not properly validate the AudienceRestriction element in SAML assertions.

Specifically, the buildSp function in the saml_sp.go file never sets the AudienceURI on the gosaml2 SAMLServiceProvider struct and does not check the WarningInfo.NotInAudience field.

As a result, Casdoor may accept SAML assertions that were issued for other service providers, potentially allowing unauthorized access.

Impact Analysis

This vulnerability can impact you by allowing an attacker to use SAML assertions intended for other service providers to gain unauthorized access to your Casdoor instance.

Because the AudienceRestriction is not validated, the system may accept assertions that should be rejected, potentially leading to unauthorized authentication and access.

Hi! I’m here to help you understand CVE-2026-9093. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70