Executive Summary

This vulnerability exists in Casdoor versions 2.362.0 and earlier, where the SAML service provider implementation does not properly validate the AudienceRestriction element in SAML assertions.

Specifically, the buildSp function in the saml_sp.go file never sets the AudienceURI on the gosaml2 SAMLServiceProvider struct and does not check the WarningInfo.NotInAudience field.

As a result, Casdoor may accept SAML assertions that were issued for other service providers, potentially allowing unauthorized access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to use SAML assertions intended for other service providers to gain unauthorized access to your Casdoor instance.

Because the AudienceRestriction is not validated, the system may accept assertions that should be rejected, potentially leading to unauthorized authentication and access.

Useful 0 Not Useful 0