CVE-2026-90942: Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-14 · updated 2026-09-23
Weakness: CWE-863

Description

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.

Affected products

Casdoor: through 4.4.0

References

https://github.com/casdoor/casdoor
https://github.com/casdoor/casdoor/blob/v4.4.0/controllers/cert.go
https://github.com/casdoor/casdoor/blob/v4.4.0/object/cert.go
https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-3-organization-admin-can-read-the-global-built-in-jwt-signing-private-key-via-apiget-certs-and-apiget-cert-incomplete-fix-of-3003--enables-cross-organization-token-forgery
https://www.vulncheck.com/advisories/casdoor-through-4.4.0-private-key-exposure-via-certificate-endpoints

Get alerted when CVE-2026-90942 or the next vulnerability affects your stack