CVE-2026-105307

Executive Summary

CVE-2026-105307 is a missing authentication vulnerability in Casdoor, an open-source identity and access management (IAM) / single sign-on platform, affecting versions up to and including 3.161.1. The flaw resides in the ApiFilter function within routers/authz_filter.go, where manipulation of an API endpoint request results in authentication controls being bypassed. With a CVSS v3.1 base score of 7.3 (High), a public exploit, and no vendor patch or response, internet-exposed Casdoor deployments are at immediate risk of unauthorized access to protected API functionality that should require an authenticated session.

Technical Analysis

Casdoor is a federated identity platform providing OAuth 2.0 / OIDC, SAML, LDAP, and CAS authentication, commonly deployed as an authentication gateway for other applications. It exposes both a web UI and a REST API used for token issuance, user management, and resource administration.

The vulnerability is classified as CWE-287 (Improper Authentication) and is localized to the ApiFilter function in the file routers/authz_filter.go. This function is part of the router middleware layer that enforces authorization and authentication checks before requests reach handler functions. According to the NVD description, "performing a manipulation" of a request to the affected API endpoint results in a missing authentication condition — i.e., the filter fails to correctly validate the requester's authentication state, allowing a request to proceed as though it were authenticated.

At the vulnerability-class level, improper authentication in a routing filter typically manifests in one of the following ways:

• A path-matching or prefix-matching logic flaw that allows a request to be routed to a protected handler without passing through the authentication branch of the filter.
• Incorrect handling of a request property (such as a header, method, or path normalization difference) that causes the filter to short-circuit its authentication requirement.
• A default-allow condition when an expected authentication attribute is absent or malformed, rather than failing closed.

The CVSS vector indicates the attack is network-reachable (AV:N), requires no privileges (PR:N) and no user interaction (UI:N), and has low complexity (AC:L). Impact is rated Low across confidentiality, integrity, and availability (C:L/I:L/A:L), which — combined with the scope-unchanged rating (S:U) — suggests the bypass grants access to a subset of protected API operations rather than full system compromise. Note that the scope of accessible functionality is not enumerated in the available advisory data.

Critically, the NVD entry states the exploit is "now public and may be used," and the affected vendor did not respond to early notification. No Nuclei template, no CISA KEV listing, and no vendor advisory are currently available. The specific HTTP method, endpoint, or parameter used in the manipulation is not disclosed in the description and is therefore not reproduced here.

Exploitation Scenarios

No public PoC details (endpoint, method, or parameter) are provided in the NVD Description. The following chain is inferred strictly from the vulnerability class (CWE-287, improper authentication in a routing filter) and must not be treated as confirmed implementation detail.

1. Reconnaissance / target identification. An attacker scans for internet-exposed Casdoor instances. Because Casdoor presents a distinctive web UI and API (e.g., a service identifiable by its title or HTML fingerprints), Shodan or similar services can enumerate candidate hosts. The attacker confirms a Casdoor instance and identifies the API endpoint surface exposed by the application.

2. Triggering the flaw class. The attacker crafts a request to the API endpoint covered by the ApiFilter function that "manipulates" the request in a manner causing authentication to be skipped. In improper-authentication filter flaws, this class of manipulation typically involves altering request routing properties (path, method, or headers) so that the filter's authentication branch is not entered for a request that is nonetheless dispatched to a protected handler. The precise manipulation is not described in the source data.

3. Execution method (class level). The crafted request is sent directly over the network to the target — no credentials, session token, or prior authentication are required (PR:N). Because the flaw is a logic defect in the filter rather than an injection flaw, no payload encoding or memory corruption technique is needed; the bypass succeeds when the routing/authentication check is evaded.

4. Post-exploitation impact. Successful bypass grants unauthenticated access to functionality the attacker was not authorized to reach. Given the Low C/I/A impact rating, this is expected to be a limited-scope unauthorized access — potentially to API operations that reveal or modify identity data, depending on which handlers sit behind the misconfigured filter. Consequences for an IAM product include the risk of enumerating or probing user/identity records and, where modification operations are exposed, tampering with authentication-related data. The full blast radius is not specified in the available advisory.

Impact Assessment

CVSS v3.1: 7.3 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

• Confidentiality (Low): Unauthenticated access to protected API responses may leak a limited subset of information. For an IAM platform this is significant because leaked data may include identity or configuration metadata.
• Integrity (Low): The bypass may permit modification of a limited set of protected resources, depending on the exposed handlers.
• Availability (Low): Limited potential to disrupt affected API operations.
• Scope (Unchanged): The impact is confined to the vulnerable component's security authority.

Business impact. Casdoor commonly functions as the authentication backbone for other applications. An authentication bypass in an IAM component weakens the trust anchor of dependent systems; even a limited-scope bypass undermines the guarantee that Casdoor validates identity correctly. Organizations that expose Casdoor to the internet should treat this as a priority issue given the public exploit and the absence of a vendor fix.

Blast radius. Any Casdoor deployment at version ≤ 3.161.1 with its API reachable by untrusted networks. Internally segmented deployments are at reduced risk but not immune to a motivated insider or attacker with network access.

Detection Guidance

Detection focuses on anomalous requests to Casdoor API endpoints that bypass or omit expected authentication context. Because the exact manipulated parameter is unknown, rules target the general pattern: API requests to Casdoor-presenting services lacking authentication artifacts, and bursty or anomalous access to protected endpoints.

Sigma Rule

title: Casdoor API Authentication Bypass Attempt (CVE-2026-105307)
id: 8f3c1a2e-5b7d-4c9a-9e21-0a1b2c3d4e5f
status: experimental
description: Detects requests to Casdoor API endpoints that omit authentication artifacts, consistent with the ApiFilter authentication bypass in routers/authz_filter.go (CVE-2026-105307).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105307
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-105307
logsource:
  category: webserver
detection:
  selection_service:
    cs-uri-stem|contains:
      - '/api/'
  selection_casdoor:
    cs-host|contains: 'casdoor'
  filter_auth_headers:
    cs(Cookie)|contains:
      - 'casdoor_session_id'
    cs(Authorization)|startswith: 'Bearer '
  condition: selection_service and selection_casdoor and not filter_auth_headers
falsepositives:
  - Public unauthenticated endpoints (e.g., login, health checks)
  - Legitimate clients using non-standard auth mechanisms
level: medium

YARA Rule

rule CVE_2026_105307_Casdoor_AuthBypass
{
    meta:
        description = "Detects Casdoor source artifacts referencing the vulnerable ApiFilter authentication logic (CVE-2026-105307)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105307"
        severity = "high"

    strings:
        $f1 = "authz_filter.go" ascii wide
        $f2 = "ApiFilter" ascii wide
        $f3 = "routers/" ascii wide
        $cve = "CVE-2026-105307" ascii wide

    condition:
        uint32(0) == 0x464c457f or
        (($f1 or $f2) and $f3) or
        $cve
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105307 Casdoor API Authentication Bypass Attempt"; flow:established,to_server; http.host; content:"casdoor"; nocase; http.uri; content:"/api/"; nocase; pcre:"/Authorization\x3a\x20Bearer/i"; negate; cookie; content:"casdoor_session_id"; nocase; negate; threshold:type both, track by_src, count 10, seconds 60; reference:cve,2026-105307; classtype:attempted-admin; sid:2026105307; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method in ("GET","POST","PUT")
      and url.path : "/api/*"
      and not http.request.headers.authorization : "Bearer *" ]
  [ network where http.request.method in ("GET","POST","PUT")
      and url.path : "/api/*"
      and not http.request.headers.cookie : "*casdoor_session_id*" ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri_path, url, cs_uri_stem)
| eval host=coalesce(host, cs_host, dest_host)
| where like(host, "%casdoor%") AND like(uri, "%/api/%")
| eval has_bearer=if(match(coalesce(authorization, cs_authorization, ""), "(?i)Bearer\s"), 1, 0)
| eval has_cookie=if(match(coalesce(cookie, cs_cookie, ""), "(?i)casdoor_session_id"), 1, 0)
| where has_bearer=0 AND has_cookie=0
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri
| where count > 5
| sort - count
| table first_seen last_seen src_ip host uri count

Wazuh OSSEC Rule

<group name="web,casdoor,cve-2026-105307,">
  <rule id="2026105" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/api/</field>
    <description>CVE-2026-105307: Unauthenticated request to Casdoor API endpoint observed.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_105307,authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix is available. The vendor was contacted about the disclosure but did not respond, and no patch evidence exists from any tracked source. The following guidance is therefore mitigation-only.

1) Immediate mitigations

• Remove direct internet exposure of the Casdoor API immediately where operationally feasible; place it behind a VPN, zero-trust proxy, or IP allowlist.
• Enforce an upstream authenticating reverse proxy (e.g., mutual TLS or an identity-aware proxy) in front of Casdoor so that requests reaching the application have already been authenticated out-of-band, compensating for the broken in-app filter.
• Rate-limit and monitor /api/-scoped traffic; alert on unauthenticated requests as defined in the detection rules above.
• Review whether any dependent applications rely on Casdoor tokens and assess whether they can tolerate short-term degradation while exposure is reduced.

2) Patch/upgrade steps

• No fixed version exists as of this report. Track the Casdoor project releases and monitor the NVD entry for a vendor advisory.
• When a patched release appears, upgrade the Casdoor server and any embedded SDK components and re-deploy.
• Because the vendor has not responded, avoid assuming a fix is imminent; plan for continued compensating controls.

3) Long-term hardening

• Enforce a fail-closed authentication model in any custom or forked routing filters: absent or ambiguous authentication state must deny, never allow.
• Deploy defense-in-depth so a single middleware regression cannot expose the API (upstream auth, network segmentation, WAF rules).
• Maintain an SBOM and asset inventory that tracks Casdoor version and exposure to enable rapid identification of affected instances.
• Establish monitoring for identity-provider API anomalies as a standing detection use case, given IAM systems are high-value targets (T1190).

References

• NVD — CVE-2026-105307: https://nvd.nist.gov/vuln/detail/CVE-2026-105307
• MITRE CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — Not yet scored for this CVE (no value available at time of writing): https://www.first.org/epss/
• Casdoor project (vendor; no advisory issued, no response to disclosure): https://github.com/casdoor/casdoor

No CISA KEV listing exists for this CVE. No named threat actor campaign or confirmed in-the-wild exploitation evidence is available in the source data; however, the NVD description explicitly states the exploit is public and "may be used."