What’s Vulnerable › Vulnerabilities

CVE-2026-9090: CVE-2026-9090

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-28 · updated 2026-06-17

Description

Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.

Affected products

• Casdoor: through 2.362.0

References

• https://kb.cert.org/vuls/id/780781

Get alerted when CVE-2026-9090 or the next vulnerability affects your stack