Critical severity9.6NVD Advisory· Published Sep 14, 2026· Updated Sep 14, 2026

CVE-2026-90942

Description

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Casdoor/Casdoorllm-fuzzy
Range: <=4.4.0

Patches

Vulnerability mechanics

References

github.com/casdoor/casdoor/blob/v4.4.0/controllers/cert.gonvd
github.com/casdoor/casdoor/blob/v4.4.0/object/cert.gonvd
github.com/geo-chen/oss/blob/main/casdoor.mdnvd
www.vulncheck.com/advisories/casdoor-through-4.4.0-private-key-exposure-via-certificate-endpointsnvd

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000