CVE-2026-9097
Description
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Casdoor 2.362.0 and earlier fail to check token revocation in JWT exchange, allowing use of invalidated tokens.
Vulnerability
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. This affects all token exchange operations where a valid-signed but revoked token could be reused [1].
Exploitation
An attacker who possesses a JWT that was previously valid but has since been revoked (e.g., due to session termination, password change, or administrative action) can present that token as part of a token exchange request. The function accepts the token because it only checks the signature and claim structure without consulting the database for revocation status. No special network position or additional authentication is required beyond holding the revoked token [1].
Impact
Successful exploitation allows the attacker to continue using a revoked token, effectively bypassing the administrator's ability to terminate active sessions or invalidate compromised tokens. This leads to persistent unauthorized access and violates the expected confidentiality and integrity of the session management mechanism [1].
Mitigation
As of the publication date (2026-05-28), no fixed version has been released. Administrators should monitor the Casdoor project for patches that implement a revocation check in the token exchange flow. No workaround is documented in available references. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [1].
AI Insight generated on May 28, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"Missing revocation check in token exchange: GetTokenExchangeToken() never queries the Token table to verify whether the subject token is still active."
Attack vector
An attacker who possesses a previously-issued JWT token — even one that has been explicitly revoked by an administrator — can present it to the token exchange endpoint. Because `GetTokenExchangeToken()` validates only the JWT signature and claims without checking the Token table for revocation status, the exchange succeeds [ref_id=1]. This allows an attacker to continue using compromised or revoked tokens indefinitely, bypassing administrative revocation actions.
Affected code
The vulnerability resides in the `GetTokenExchangeToken()` function in `object/token_oauth.go` [ref_id=1]. This function validates the JWT signature and parses its claims but never queries the Token table to check whether the subject token has been revoked or invalidated [ref_id=1].
What the fix does
The advisory does not provide a patch diff, but the remediation is clear: the `GetTokenExchangeToken()` function must query the Token table to verify that the subject token's status is still active (i.e., not revoked or invalidated) before completing the exchange [ref_id=1]. Without this check, administrators cannot effectively terminate sessions or revoke compromised tokens, as revoked tokens remain usable for exchange.
Preconditions
- inputAttacker must possess a valid JWT token that was previously issued by Casdoor
- configThe token may have been revoked or invalidated by an administrator — the vulnerability still allows its use
Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.