Critical severity9.8NVD Advisory· Published May 28, 2026· Updated Jun 2, 2026
CVE-2026-9094
CVE-2026-9094
Description
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
1News mentions
1- Casdoor: Nine SAML & SSO Flaws Disclosed, Including Critical Auth Bypass (CVE-2026-9090)Vypr Intelligence · May 28, 2026