Executive Summary

This vulnerability exists in Casdoor versions 2.362.0 and earlier, where the system does not verify if a JWT (JSON Web Token) used for token exchange is still active.

Specifically, the GetTokenExchangeToken() function validates the JWT signature and parses its claims but fails to check the Token table to confirm whether the token has been revoked or invalidated.

Because this revocation check is missing, administrators cannot terminate active sessions or revoke tokens that may have been compromised.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow unauthorized access to systems because compromised or revoked tokens remain valid and usable.

Administrators are unable to terminate active sessions or revoke tokens, which means attackers could maintain persistent access even after a token should have been invalidated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in Casdoor allows tokens to remain active without verification of revocation, preventing administrators from terminating active sessions or revoking compromised tokens.

Such a flaw can impact compliance with standards and regulations like GDPR and HIPAA, which require strict control over user session management and the ability to revoke access promptly to protect personal and sensitive data.

Failure to revoke compromised tokens may lead to unauthorized access, increasing the risk of data breaches and non-compliance with data protection requirements.

Useful 0 Not Useful 0