CVE-2026-9096

Executive Summary

CVE-2026-9096 is a critical security vulnerability in Casdoor, an open-source identity and access management (IAM) platform. The flaw resides in the SAML assertion processing logic. Casdoor versions 2.362.0 and earlier fail to enforce SAML assertion time bounds (NotOnOrAfter and NotBefore). While the underlying gosaml2 library correctly computes and reports these time validation results in the assertionInfo.WarningInfo field, the ParseSamlResponse() function in Casdoor never reads this field. This means that expired or not-yet-valid SAML assertions are accepted, allowing an attacker to reuse a stolen or intercepted SAML assertion indefinitely, bypassing authentication and gaining unauthorized access to any account.

Supply Chain & Package Security

This vulnerability is in the Go-based Casdoor application. The gosaml2 library is a dependency that correctly performs time validation, but Casdoor's code ignores the results. This is a classic supply chain logic error where a security feature provided by a dependency is not consumed by the application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed to exploit.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - An attacker can impersonate any user.
• Integrity (I): High (H) - An attacker can perform actions as the impersonated user.
• Availability (A): None (N) - The vulnerability does not affect availability.

CVSS Score: 9.1 (Critical)

Threat Level: Critical. The vulnerability allows for complete account takeover with no user interaction. Any SAML IdP that issues assertions to a vulnerable Casdoor instance is a potential attack vector.

Deep Dive & Mechanics

The vulnerability is a logic flaw in the SAML response parsing flow.

1. SAML Assertion Reception: Casdoor receives a SAML response from an Identity Provider (IdP).
2. Library Processing: The gosaml2 library parses the SAML assertion. It checks the NotBefore and NotOnOrAfter conditions. If the assertion is used outside the valid time window, the library populates the assertionInfo.WarningInfo field with a warning (e.g., "Assertion is not yet valid" or "Assertion is expired").
3. Casdoor's Flawed Logic: Casdoor's ParseSamlResponse() function calls the library and receives the assertionInfo struct. However, it never checks the WarningInfo field. It proceeds to extract the user identity from the assertion and issue a session.
4. Exploitation: An attacker who intercepts a valid SAML assertion (e.g., via a man-in-the-middle attack, or by stealing it from a compromised client) can replay that assertion at any time, even long after it has expired. The Casdoor server will accept it and create a valid session for the victim user.

Vulnerable vs. Patched Code

Vulnerable Code (Casdoor <= 2.362.0):

func ParseSamlResponse(samlResponse string) (*AssertionInfo, error) {
    // ... library call ...
    assertionInfo, err := samlService.ParseSamlResponse(samlResponse)
    if err != nil {
        return nil, err
    }
    // BUG: No check of assertionInfo.WarningInfo
    // The code proceeds to extract user data and create a session.
    return assertionInfo, nil
}

Patched Code (Hypothetical):

func ParseSamlResponse(samlResponse string) (*AssertionInfo, error) {
    assertionInfo, err := samlService.ParseSamlResponse(samlResponse)
    if err != nil {
        return nil, err
    }
    // FIX: Check for time validation warnings
    if len(assertionInfo.WarningInfo) > 0 {
        for _, warning := range assertionInfo.WarningInfo {
            if strings.Contains(warning, "NotBefore") || strings.Contains(warning, "NotOnOrAfter") {
                return nil, fmt.Errorf("SAML assertion time validation failed: %s", warning)
            }
        }
    }
    return assertionInfo, nil
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid SAML assertion for a target user (e.g., admin@example.com). This can be obtained by:
  • Intercepting network traffic (e.g., using a proxy like Burp Suite).
  • Compromising a client machine that has a valid session.
  • If the IdP is misconfigured, an attacker might be able to forge assertions (though this is separate from this CVE).

Exploitation Steps:

1. Capture a SAML Assertion: Use a tool like Burp Suite to intercept a SAML response from the IdP to the Casdoor /api/login/saml endpoint.
2. Replay the Assertion: Send a POST request to the Casdoor SAML callback endpoint with the captured SAML response. The assertion can be days, months, or years old.

   curl -X POST https://victim-casdoor.com/api/login/saml \
     -d "SAMLResponse=<base64_encoded_assertion>"
   

3. Receive Session: Casdoor will return a session cookie or token, granting the attacker full access as the victim user.

Blue Team (Defender)

Detection:

• Monitor SAML Response Logs: Look for SAML assertions that are being used outside their valid time window. This is the primary indicator.
• Anomalous Session Creation: Alert on sessions created for users who have not recently authenticated via the IdP.
• Replay Detection: Implement a SAML assertion cache (e.g., using the InResponseTo attribute or assertion ID) to detect replay attacks. This is a separate mitigation but highly recommended.

Hunting Query (Splunk):

index=casdoor sourcetype=saml_logs
| eval assertion_age = now() - strptime(assertion_issue_instant, "%Y-%m-%dT%H:%M:%SZ")
| where assertion_age > 3600
| stats count by user, assertion_id, src_ip

Indicators of Compromise (IOCs)

• Network: SAML responses with NotBefore or NotOnOrAfter timestamps that are significantly in the past or future relative to the current time.
• Logs: Casdoor logs showing successful SAML logins where the assertion_issue_instant is older than the session creation time by more than a few minutes.
• Session: Session tokens created without a corresponding recent authentication event at the IdP.

Detection Engineering

YARA Rule

rule Detect_Casdoor_SAML_Time_Bypass {
    meta:
        description = "Detects Casdoor SAML responses that ignore time validation"
        author = "Valters IT"
        date = "2026-01-01"
        hash = "unknown"
    strings:
        $saml_response = "SAMLResponse"
        $warning_info = "WarningInfo"
        $not_before = "NotBefore"
        $not_on_or_after = "NotOnOrAfter"
    condition:
        $saml_response and not ($warning_info and ($not_before or $not_on_or_after))
}

Sigma Rule

title: Casdoor SAML Time Validation Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SAML assertions being accepted without time validation in Casdoor
logsource:
    product: casdoor
    service: saml
detection:
    selection:
        event: "SAML login successful"
    condition: selection
    timeframe: 5m
falsepositives:
    - Legitimate use of long-lived assertions (rare)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-9096 - Casdoor SAML Time Validation Bypass";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/login/saml"; http_uri;
    content:"SAMLResponse"; http_client_body;
    pcre:"/SAMLResponse=[A-Za-z0-9+/=]+/";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Casdoor: Apply the official patch as soon as it is released. Monitor the Casdoor GitHub repository for updates.
2. Implement Workaround: If patching is not immediately possible, implement a reverse proxy (e.g., Nginx, HAProxy) that inspects SAML responses and rejects those with expired or future timestamps. This is a complex workaround.
3. Enable SAML Replay Protection: Configure the IdP to use the InResponseTo attribute and ensure Casdoor validates it (if a future patch adds this feature).

Long-Term Mitigations:

• Code Review: Conduct a thorough code review of all SAML-related logic to ensure all security features provided by the gosaml2 library are consumed.
• Unit Tests: Add unit tests that specifically test SAML time validation with expired and future assertions.
• Security Scanning: Integrate static analysis (SAST) tools that can detect when security-relevant fields from library calls are ignored.

Valters IT Securing your digital frontier.