CVE-2026-9093

Executive Summary

CVE-2026-9093 is a critical authentication bypass vulnerability in Casdoor, an open-source identity and access management (IAM) platform. The flaw resides in the SAML service provider (SP) implementation, specifically within the object/saml_sp.go file. The buildSp function fails to set the AudienceURI on the gosaml2 SAMLServiceProvider struct and does not inspect the WarningInfo.NotInAudience field. This omission allows an attacker to forge or reuse SAML assertions intended for other service providers, effectively bypassing authentication and gaining unauthorized access to the Casdoor instance.

The vulnerability affects all Casdoor versions up to and including 2.362.0. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The CVSS score is 9.8 (Critical), indicating a severe risk of complete compromise of confidentiality, integrity, and availability.

Supply Chain & Package Security

Casdoor is a Go-based application. The vulnerability is introduced through the misuse of the gosaml2 library. Organizations using Casdoor as a SAML SP should treat this as a critical supply chain risk, as the flaw is in the core authentication logic, not a third-party dependency. The gosaml2 library itself is not vulnerable; rather, Casdoor's implementation fails to enforce audience restrictions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the affected resource are the same.
• Confidentiality Impact: High (C:H) – Full read access to all data.
• Integrity Impact: High (I:H) – Full write access to all data.
• Availability Impact: High (A:H) – Potential for denial of service or full system compromise.

Threat Level: Critical. An unauthenticated attacker can impersonate any user by presenting a valid SAML assertion from any trusted IdP, even if that assertion was issued for a different service provider.

Deep Dive & Mechanics

The vulnerability is rooted in the SAML protocol's AudienceRestriction element. In a secure SAML SP implementation, the SP must verify that the Audience in the assertion matches its own entity ID. This prevents a malicious or compromised IdP from issuing an assertion for one SP and having it accepted by another.

In Casdoor, the buildSp function in object/saml_sp.go creates a gosaml2.SAMLServiceProvider struct. The struct has an AudienceURI field that should be set to the SP's own entity ID. However, the code never sets this field, leaving it as an empty string. Additionally, after processing a SAML response, the gosaml2 library returns a WarningInfo struct that includes a NotInAudience field. Casdoor's code does not check this field.

The attack flow is as follows:

1. An attacker obtains a valid SAML assertion from a trusted IdP. This assertion could be for any service provider that the IdP trusts.
2. The attacker sends this assertion to the Casdoor SAML endpoint.
3. Casdoor's buildSp function processes the assertion without validating the AudienceRestriction.
4. The gosaml2 library may set WarningInfo.NotInAudience to true, but Casdoor ignores it.
5. Casdoor accepts the assertion and authenticates the user, granting access to the Casdoor instance.

This effectively allows an attacker to bypass authentication by reusing SAML assertions from other SPs.

Vulnerable vs. Patched Code

The vulnerable code is in object/saml_sp.go. The buildSp function is responsible for configuring the gosaml2.SAMLServiceProvider. The critical missing lines are:

Vulnerable Code (Casdoor <= 2.362.0):

func buildSp() *gosaml2.SAMLServiceProvider {
    sp := &gosaml2.SAMLServiceProvider{
        // ... other fields ...
        // AudienceURI is NOT set
    }
    return sp
}

Patched Code (Hypothetical):

func buildSp() *gosaml2.SAMLServiceProvider {
    sp := &gosaml2.SAMLServiceProvider{
        // ... other fields ...
        AudienceURI: "https://casdoor.example.com/saml/metadata", // Set to SP's entity ID
    }
    return sp
}

Additionally, the code that processes the SAML response must check WarningInfo.NotInAudience:

Vulnerable Code:

assertionInfo, err := sp.RetrieveAssertionInfo(r.FormValue("SAMLResponse"))
// No check for assertionInfo.WarningInfo.NotInAudience

Patched Code:

assertionInfo, err := sp.RetrieveAssertionInfo(r.FormValue("SAMLResponse"))
if err != nil {
    // handle error
}
if assertionInfo.WarningInfo.NotInAudience {
    // reject assertion
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Casdoor instance (version <= 2.362.0) with SAML SP enabled.
• A valid SAML assertion from a trusted IdP. This assertion must be for a different SP (e.g., https://other-app.example.com).
• Network access to the Casdoor SAML endpoint (typically /api/saml/acs).

Exploitation Steps:

1. Obtain a valid SAML assertion from the trusted IdP. This can be done by intercepting a legitimate SAML response or by registering a malicious SP with the IdP.
2. Send a POST request to the Casdoor SAML ACS endpoint with the assertion:

   curl -X POST https://casdoor.example.com/api/saml/acs \
        -d "SAMLResponse=<base64_encoded_assertion>"
   

3. Casdoor will process the assertion and authenticate the user, granting access to the Casdoor dashboard.

Expected Outcome: The attacker gains access to the Casdoor instance as the user identified in the SAML assertion.

Blue Team

Detection:

• Monitor SAML ACS endpoints for unexpected assertions.
• Look for SAML assertions with Audience values that do not match the Casdoor SP entity ID.
• Check Casdoor logs for WarningInfo.NotInAudience warnings (if logging is enabled).

Mitigation:

• Immediately restrict network access to the Casdoor SAML endpoint to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to inspect SAML assertions and reject those with mismatched Audience.
• Monitor for unusual authentication patterns, such as logins from unexpected users or at unusual times.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/saml/acs with SAML assertions containing Audience values not matching the Casdoor SP entity ID.
  • SAML assertions with Issuer values that do not match the configured IdP.
• Log IOCs:
  • Casdoor logs showing successful authentication without a corresponding IdP-initiated login.
  • Log entries containing WarningInfo.NotInAudience (if logging is enabled).
• File IOCs:
  • Modified object/saml_sp.go file (if an attacker has code execution).
  • Unauthorized user accounts or roles in the Casdoor database.

Detection Engineering

YARA Rule

rule CVE_2026_9093_Casdoor_SAML_Audience_Bypass {
    meta:
        description = "Detects Casdoor SAML SP code missing AudienceURI validation"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-9093"
        severity = "critical"
    strings:
        $s1 = "buildSp" ascii nocase
        $s2 = "SAMLServiceProvider" ascii nocase
        $s3 = "AudienceURI" ascii nocase
        $s4 = "WarningInfo" ascii nocase
        $s5 = "NotInAudience" ascii nocase
    condition:
        $s1 and $s2 and not $s3 and not ($s4 and $s5)
}

Sigma Rule

title: CVE-2026-9093 - Casdoor SAML Audience Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SAML assertions with mismatched Audience values targeting Casdoor
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-9093
logsource:
    category: application
    product: casdoor
detection:
    selection:
        event: "SAMLResponse"
        audience: "https://*"
    condition: selection and not audience == "https://casdoor.example.com/saml/metadata"
falsepositives:
    - Legitimate SAML assertions from trusted IdPs for other SPs (should be rejected)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9093 - Casdoor SAML Audience Bypass"; flow:to_server; content:"POST"; http_method; content:"/api/saml/acs"; http_uri; content:"SAMLResponse"; http_client_body; pcre:"/Audience[^>]+>(?!https:\/\/casdoor\.example\.com\/saml\/metadata)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SAML SP functionality in Casdoor if not required.
2. Restrict network access to the SAML ACS endpoint (/api/saml/acs) to trusted IPs only.
3. Implement a reverse proxy (e.g., Nginx, HAProxy) to inspect and validate SAML assertions before they reach Casdoor.

Long-Term Fix:

1. Patch the code by setting the AudienceURI field in the buildSp function to the Casdoor SP's entity ID.
2. Add validation of WarningInfo.NotInAudience after processing SAML responses.
3. Upgrade to a patched version of Casdoor once available.

Workaround:

• If you cannot patch immediately, consider using an alternative SAML SP implementation (e.g., a dedicated SAML proxy) in front of Casdoor.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert