CVE-2026-90942

Executive Summary

CVE-2026-90942 is a critical improper authorization vulnerability (CWE-863) in Casdoor, an open-source identity and access management (IAM) / single sign-on platform. Through version 4.4.0, the /api/get-certs and /api/get-cert endpoints fail to properly mask the instance-wide built-in certificate private key, permitting an authenticated organization administrator to retrieve the global private key. Because Casdoor uses this built-in key to sign JWT tokens, an attacker holding it can forge valid tokens for any user in any organization — including global administrators — resulting in full authentication bypass and complete compromise of the identity provider. The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical), is unpatched per available evidence, and has no public PoC or KEV listing, though the low EPSS (0.00210) may reflect the recent assignment rather than true risk.

Technical Analysis

Casdoor is a centralized authentication platform that issues JSON Web Tokens (JWTs) to federated applications and manages users, organizations, and applications. A core function of the platform is cryptographic trust: it maintains a built-in certificate whose private key signs the JWTs it issues. Any relying party that trusts Casdoor validates incoming JWTs against the corresponding public key.

CVE-2026-90942 is a broken access control / improper authorization flaw (CWE-863). The API endpoints /api/get-certs and /api/get-cert are intended to expose certificate metadata. According to the NVD description, they fail to "properly mask the instance-wide built-in certificate private key." In practice, this means the private key material is returned in the API response rather than being redacted. The missing masking is an authorization failure — the code does not enforce a boundary between what a non-privileged organization administrator should see (certificate metadata) and what must never be exposed (the signing private key).

The attack surface is the Casdoor HTTP API, reachable over the network (AV:N). The actor requires only low privileges (PR:L) — the description explicitly names organization administrators as the class able to retrieve the key. No user interaction (UI:N) is needed. The security scope changes (S:C) because the compromised key affects every organization and relying application, not merely the attacker's own organization.

Critically, the exposed key is the instance-wide built-in key. It is used to sign tokens for the entire Casdoor deployment. Possession of the private key defeats the platform's core trust guarantee: an attacker can mint a JWT with arbitrary claims (subject, user identity, organization) and sign it correctly, so downstream services will accept it as legitimate. Because the key is global, organizations that are otherwise isolated from one another are all placed at risk. The vulnerability's confidentiality and integrity impacts are both High (C:H/I:H); availability is not directly affected (A:N).

No specifics on the exact response field, authorization middleware, or code path are provided in the source data, and none are fabricated here. Patch confidence is 0/4 — no patch evidence exists from any tracked source, and no workaround is documented.

Exploitation Scenarios

The following chain is inferred from the vulnerability class and the NVD description. No public PoC exists (POC_STATUS: None), and no implementation detail beyond the two named endpoints is asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or network-exposed Casdoor instance (version <= 4.4.0) and confirms reachability of the API. Shodan dorks such as http.title:"Casdoor" or body matches for /api/get-certs can identify candidate targets. The attacker must obtain credentials for an organization administrator account, since PR:L requires some privilege level.

2. Triggering the flaw class. Leveraging improper authorization, the organization administrator calls the affected certificate endpoints (/api/get-certs and/or /api/get-cert). Because the instance-wide built-in certificate's private key is not properly masked, the response returns private key material that the requester should never be permitted to see. The authorization boundary that should block a tenant-scoped administrator from global signing material is absent or insufficient.

3. Payload / execution. With the private key in hand, the attacker forges JWT tokens. Using standard JWT tooling, they craft a token with arbitrary claims — selecting any user identity in any organization, including global administrators — and sign it with the stolen key. No exploitation of a memory-safety bug or code execution primitive is required; the attack is purely cryptographic abuse of a leaked secret.

4. Post-exploitation impact. Downstream applications and Casdoor itself accept the forged tokens as authentic. The attacker achieves complete authentication bypass and can impersonate global administrators, escalate privileges across all organizations, access protected resources, and potentially modify users, applications, or configuration within Casdoor — effectively total compromise of the identity provider and every relying service. Because scope changes (S:C), a single low-privileged account compromises the whole deployment.

Impact Assessment

The CVSS v3.1 base score is 9.6 (Critical). Subscore reasoning: AV:N (network-reachable API), AC:L (no special conditions or race required — a straightforward authenticated request), PR:L (organization administrator credentials suffice), UI:N (no victim interaction), S:C (compromise of the global signing key impacts resources beyond the attacker's organization), C:H (the private key and, transitively, all protected data become accessible), I:H (forged tokens allow impersonation and modification of identity/state), A:N (no direct availability impact).

Business impact is severe. Casdoor typically serves as the identity provider for an entire web estate. Compromise of the instance-wide signing key enables impersonation of any principal, including global administrators, breaking single sign-on trust for every connected application. The blast radius spans all organizations and all relying services within the deployment. Attackers could persist by minting long-lived tokens, exfiltrate data from downstream systems, or alter authorization state. Given that the key is built-in and shared, rotation is operationally sensitive, and isolation between tenants is defeated. The low EPSS (0.00210, 11.5th percentile) likely reflects the novelty of the CVE and the absence of a public exploit rather than a low real-world risk; the attack requires only modest skill once the key is exfiltrated.

Detection Guidance

Sigma Rule

title: Casdoor Certificate Private Key Retrieval via API
id: 7a1c9f42-3d8e-4b21-9c77-1f2b6a9d0e55
status: experimental
description: Detects access to Casdoor /api/get-certs or /api/get-cert endpoints that may return an improperly masked instance-wide private key (CVE-2026-90942).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90942
author: Threat Intelligence
date: 2026/09/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/get-certs'
      - '/api/get-cert'
  selection_method:
    cs-method: 'GET'
  condition: selection_endpoint and selection_method
falsepositives:
  - Legitimate administrative certificate management by authorized global admins
level: high

YARA Rule

rule CVE_2026_90942_Casdoor_Key_Exposure
{
    meta:
        description = "Detects exposed Casdoor private key material in HTTP responses / logs tied to CVE-2026-90942"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90942"
        date = "2026-09-01"
    strings:
        $endpoint1 = "/api/get-certs"
        $endpoint2 = "/api/get-cert"
        $pkcs8 = "-----BEGIN PRIVATE KEY-----"
        $pkcs1 = "-----BEGIN RSA PRIVATE KEY-----"
        $cert = "-----BEGIN CERTIFICATE-----"
    condition:
        (uint16(0) == 0x4854 or true) and
        ($endpoint1 or $endpoint2) and
        ($pkcs8 or $pkcs1) and $cert
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90942 Casdoor certificate private key exposure via API"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/get-cert"; nocase; pcre:"/\/api\/get-certs?/i"; classtype:attempted-recon; reference:cve,2026-90942; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90942; sid:2026090942; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [ network where url.path in ("/api/get-certs", "/api/get-cert") and http.request.method == "GET" ]
  [ authentication where event.outcome == "success" and user.roles : "organization_admin" ]

Splunk SPL Query

index=web OR index=casdoor sourcetype=access_combined OR sourcetype=casdoor
| search cs_uri_stem IN ("/api/get-certs", "/api/get-cert")
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, cs_uri_stem, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="casdoor,web,access_control,">
  <rule id="909420" level="12">
    <if_sid>31100</if_sid>
    <url>/api/get-cert</url>
    <description>CVE-2026-90942: Possible Casdoor certificate private key retrieval via /api/get-certs or /api/get-cert</description>
    <mitre>
      <id>T1078</id>
      <id>T1552</id>
    </mitre>
    <group>cve_2026_90942,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source; vendor fix and affected-version fix data are N/A or empty.

1. Immediate mitigations.

   • Block external and cross-tenant access to /api/get-certs and /api/get-cert at the reverse proxy / WAF, allowing only essential global-administrator workflows from trusted networks.
   • Treat the instance-wide built-in certificate as compromised on any affected deployment and rotate it; regenerate the built-in certificate and private key, and update the public key at every relying application that trusts Casdoor.
   • Invalidate all previously issued JWTs by rotating signing material and, where supported, shortening token lifetimes / enforcing re-authentication.
   • Audit organization-administrator accounts and enforce least privilege; restrict who can be a tenant admin.

2. Patch / upgrade steps.

   • No fixed version is identified from tracked sources. Monitor the Casdoor project releases and the NVD record for CVE-2026-90942 for an official patch.
   • Once a fixed release is available, upgrade all instances to that version and re-validate that the certificate endpoints no longer return private key material.

3. Long-term hardening.

   • Never expose private key material through any API; return only public certificate metadata.
   • Enforce strict authorization: tenant-scoped administrators must not access instance-wide secrets.
   • Rotate all signing keys on a schedule and after any suspected exposure; implement key custody in an HSM or secrets manager where feasible.
   • Monitor API access to certificate endpoints and alert on anomalous retrievals (see Detection Guidance).

References

• NVD — CVE-2026-90942: https://nvd.nist.gov/vuln/detail/CVE-2026-90942
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• Casdoor project (vendor source): https://github.com/casdoor/casdoor
• CISA Known Exploited Vulnerabilities Catalog (no KEV entry for this CVE as of analysis): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (score 0.00210): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-90942 in the data provided; POC/Exploit status is None and CISA KEV status is NO.