Critical severity9.8NVD Advisory· Published May 28, 2026· Updated Jun 17, 2026
CVE-2026-9094
CVE-2026-9094
Description
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/casdoor/casdoorGo | < 2.387.0 | 2.387.0 |
Affected products
3- osv-coordsRange: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
4News mentions
1- Casdoor: Nine SAML & SSO Flaws Disclosed, Including Critical Auth Bypass (CVE-2026-9090)Vypr Intelligence · May 28, 2026