| Casdoor arbitrary file write vulnerabilityCVE-2022-38638 · GHSA-9VM3-R8GQ-CR6XVersion ranges need review. |
github.com/casdoor/casdoorcasdoor |
GoPyPI |
Critical
|
Fix reported |
|
| SQL Injection in CasdoorCVE-2022-24124 · GHSA-M358-G4RP-533RVersion ranges need review. |
github.com/casdoor/casdoorcasdoor |
GoPyPI |
High
|
Fix reported |
|
| Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature checkCVE-2026-9094 · GHSA-C9W5-QP6M-M395Version ranges need review. |
github.com/casdoor/casdoor |
Go |
Critical
|
Fix reported |
|
| Casdoor: Arbitrary file write possible through Local File System storage providerCVE-2026-6815 · GHSA-RMXX-V9RJ-VPVGVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Medium
|
No fix reported |
|
| Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequestCVE-2026-9098 · GHSA-MFVP-7P3V-X9MHVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Critical
|
No fix reported |
|
| Casdoor allows users to bypass configured MFA requirementsCVE-2026-9091 · GHSA-GV4M-V8C8-HR3GVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Medium
|
No fix reported |
|
| Casdoor has an authentication bypassCVE-2026-9090 · GHSA-FWGQ-J9R9-QJGRVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Critical
|
No fix reported |
|
| Casdoor doesn't verify that a JWT used for token exchange is still activeCVE-2026-9097 · GHSA-339W-3HQM-9PJCVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Critical
|
No fix reported |
|
| Casdoor does not validate the AudienceRestriction element in SAML assertionsCVE-2026-9093 · GHSA-3W4H-G9F5-J84PVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Critical
|
No fix reported |
|
| Casdoor doesn't enforce SAML assertion time boundsCVE-2026-9096 · GHSA-RGQ2-93GJ-FFXGVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
High
|
No fix reported |
|
| Casdoor vulnerable to Open RedirectCVE-2026-5467 · GHSA-MJ24-PQX2-6788Version ranges need review. |
github.com/casdoor/casdoor |
Go |
Low
|
No fix reported |
|
| Casdoor vulnerable to SSRF via crafted Webhook URLCVE-2026-5469 · GHSA-P8C7-HJC4-GWF8Version ranges need review. |
github.com/casdoor/casdoor |
Go |
Medium
|
No fix reported |
|
| Casdoor vulnerable to Stored XSS via Application formCss / formSideHtmlCVE-2026-5468 · GHSA-W799-7525-RPR6Version ranges need review. |
github.com/casdoor/casdoor |
Go |
Low
|
No fix reported |
|
| Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoorCVE-2025-4210 · GHSA-8W8F-H4CM-C4PGVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Medium
|
Fix reported |
|
| Casdoor CORS misconfiguration (GHSL-2024-035)CVE-2024-41657 · GHSA-MCHX-7J67-8MCFVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
High
|
No fix reported |
|
| Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036)CVE-2024-41658 · GHSA-GV2P-4MVG-G32HVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Medium
|
No fix reported |
|
| casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verificationCVE-2024-41264 · GHSA-67FW-W8F2-88WPVersion ranges need review. |
github.com/casdoor/casdoor |
Go |
Medium
|
No fix reported |
|
| Casdoor arbitrary file deletion vulnerability via uploadFile functionCVE-2022-44942 · GHSA-F93F-55C2-8C89Version ranges need review. |
github.com/casdoor/casdoor |
Go |
High
|
Fix reported |
|
| Casdoor is vulnerable to Improper AuthorizationCVE-2025-61524 · GHSA-5M9M-J5P7-M7F9Version ranges need review. |
github.com/casdoor/casdoor |
Go |
High
|
Fix reported |
|
| Casdoor Cross-Site Request Forgery vulnerabilityCVE-2023-34927 · GHSA-RWCP-QRWG-56CG |
github.com/casdoor/casdoor |
Go |
Medium
|
No fix reported |
|
