CVE-2026-9098 Details

A vulnerability exists in Casdoor versions through 2.362.0, where the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs. This acceptance occurs without verifying that the response corresponds to an AuthnRequest previously issued by Casdoor. Furthermore, if an administrator disables or deletes an Identity Provider (IdP) after a SAML flow has started, the handler processes the response using the provider snapshot from the beginning of the request. Consequently, an attacker controlling a registered upstream IdP can send unsolicited SAML responses or replay a captured response in a different session or after the original flow has ended. In both scenarios, Casdoor accepts the response, issues a session, and enables persistent unauthorized access.