CVE-2026-9094 Details

A vulnerability in Casdoor versions through 2.362.0 allows cross-organization token exchange, leading to privilege escalation. The issue arises in the GetTokenExchangeToken function, which validates JWT signatures but fails to ensure that the token's user is from the same organization as the target application. This oversight can result in unauthorized access across different organizations.

Users are advised to implement stricter identity governance controls, restrict the use of identity providers to trusted sources, and monitor logs for unusual SAML or token activity. High-privilege accounts should be reinforced with additional authentication measures, such as multi-factor authentication.