High severity7.5NVD Advisory· Published May 28, 2026· Updated Jun 2, 2026
CVE-2026-9096
CVE-2026-9096
Description
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
1News mentions
1- Casdoor: Nine SAML & SSO Flaws Disclosed, Including Critical Auth Bypass (CVE-2026-9090)Vypr Intelligence · May 28, 2026