CVE-2026-9097

Executive Summary

CVE-2026-9097 is a critical authorization bypass vulnerability in Casdoor, an open-source identity and access management (IAM) platform. The flaw resides in the token exchange functionality, specifically within the GetTokenExchangeToken() function in object/token_oauth.go. The application fails to verify whether a JSON Web Token (JWT) used for token exchange is still active or has been revoked. While the JWT signature is validated, the system never queries the Token table to check if the subject token has been invalidated. This allows an attacker with a compromised or previously revoked token to exchange it for a new, valid token, effectively bypassing session revocation and maintaining persistent unauthorized access.

Supply Chain & Package Security

Casdoor is a Go-based application. The vulnerability exists in the core source code, not in a third-party package. However, organizations using Casdoor as a dependency in their own Go projects should be aware that the flaw is in the upstream codebase. The lack of a patch means that any deployment of Casdoor version 2.362.0 or earlier is vulnerable. There is no known malicious package or compromised dependency associated with this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs a valid (or previously valid) JWT.
• Privileges Required (PR): None (N) - The attacker does not need any prior authentication to exploit this, only a token that was once valid.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The exploitation does not affect other components.
• Confidentiality (C): High (H) - An attacker can gain access to any resource the original token had access to.
• Integrity (I): High (H) - The attacker can perform actions on behalf of the original token owner.
• Availability (A): High (H) - The attacker can disrupt services by obtaining new tokens and performing actions.

CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability is in the GetTokenExchangeToken() function within object/token_oauth.go. The token exchange flow is designed to allow a client to exchange a short-lived token for a longer-lived one, or to refresh an expired token. The function performs the following steps:

1. Receives a JWT from the client.
2. Validates the JWT signature using the configured signing key.
3. Parses the JWT claims to extract the subject token identifier.
4. Generates a new token based on the claims.

The critical flaw: After step 2, the function does not query the Token table to check if the subject token (the one being exchanged) is still active, revoked, or expired. It assumes that if the JWT signature is valid, the token is still valid. This means:

• If an administrator revokes a token (e.g., after a user logs out or a session is terminated), the revoked token can still be used for token exchange.
• An attacker who obtains a token (even an old one) can exchange it for a new, valid token, effectively bypassing revocation.
• The attacker can maintain persistent access indefinitely by repeatedly exchanging tokens.

The missing check is a classic case of CWE-862: Missing Authorization. The function authorizes the token exchange based solely on the JWT signature, ignoring the actual state of the token in the database.

Vulnerable vs. Patched Code

Vulnerable Code (object/token_oauth.go - GetTokenExchangeToken):

func GetTokenExchangeToken(ctx context.Context, token string) (*Token, error) {
    // Parse and validate JWT
    claims, err := parseJWT(token)
    if err != nil {
        return nil, err
    }

    // Extract subject token ID
    subjectTokenID := claims.Subject

    // Generate new token (no check if subject token is active)
    newToken := &Token{
        // ... populate from claims
    }

    // Save new token
    err = AddToken(ctx, newToken)
    if err != nil {
        return nil, err
    }

    return newToken, nil
}

Patched Code (Hypothetical Fix):

func GetTokenExchangeToken(ctx context.Context, token string) (*Token, error) {
    // Parse and validate JWT
    claims, err := parseJWT(token)
    if err != nil {
        return nil, err
    }

    // Extract subject token ID
    subjectTokenID := claims.Subject

    // **FIX: Check if the subject token is still active**
    subjectToken, err := GetToken(ctx, subjectTokenID)
    if err != nil {
        return nil, err
    }
    if subjectToken == nil || !subjectToken.IsActive {
        return nil, errors.New("subject token is not active or has been revoked")
    }

    // Generate new token
    newToken := &Token{
        // ... populate from claims
    }

    // Save new token
    err = AddToken(ctx, newToken)
    if err != nil {
        return nil, err
    }

    return newToken, nil
}

The fix adds a database lookup (GetToken) to verify the subject token's active status before proceeding with the exchange.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Casdoor instance (version <= 2.362.0).
• A valid JWT token (can be obtained by logging in or intercepting a legitimate token).
• Network access to the Casdoor API endpoint.

Exploitation Steps:

1. Obtain a Token: Capture a valid JWT token from a legitimate user session. This can be done via network sniffing, phishing, or if you have access to a token that was previously revoked.
2. Craft Token Exchange Request: Send a POST request to the Casdoor token exchange endpoint (typically /api/token-exchange) with the captured JWT in the request body.
3. Receive New Token: The server will return a new, valid JWT without checking if the original token is still active.
4. Use New Token: Use the new token to access protected resources or perform actions on behalf of the original user.

Example cURL Command:

curl -X POST https://target-casdoor-instance.com/api/token-exchange \
  -H "Content-Type: application/json" \
  -d '{"token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."}'

Expected Response:

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Blue Team

Detection and Response:

1. Monitor Token Exchange Endpoint: Log all requests to /api/token-exchange. Look for patterns where the same subject token is used multiple times for exchange, especially if the original token was revoked.
2. Correlate with Revocation Logs: Cross-reference token exchange requests with token revocation events. If a token is exchanged after it was revoked, this is a clear indicator of exploitation.
3. Implement Temporary Workaround: If patching is not immediately possible, consider disabling the token exchange endpoint entirely or implementing a custom middleware that checks token status before allowing exchange.
4. Audit Token Usage: Regularly audit active tokens and their origins. Look for tokens that were generated via exchange from a revoked token.

Detection Rule (Sigma):

title: Casdoor Token Exchange After Revocation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects token exchange requests where the subject token was previously revoked.
author: Valters IT
logsource:
    product: casdoor
    service: token
detection:
    selection:
        event: token_exchange
        subject_token_status: revoked
    condition: selection
falsepositives:
    - Legitimate token refresh before revocation is fully propagated.
level: high

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated POST requests to /api/token-exchange from the same IP address.
  • JWT tokens with unusual iat (issued at) timestamps that are older than expected.
  • Multiple token exchange requests for the same subject token within a short time frame.

• Log IOCs:

  • Log entries showing token exchange events where the subject token ID matches a previously revoked token.
  • Log entries with subject_token_status set to revoked in the token exchange event.

• File IOCs:

  • Modified object/token_oauth.go file (if an attacker has code execution).
  • Unauthorized tokens in the Token table with is_active set to true but originating from a revoked token.

Detection Engineering

YARA Rule

rule Casdoor_Token_Exchange_Revocation_Bypass {
    meta:
        description = "Detects Casdoor source code missing token revocation check"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-9097"
    strings:
        $func_decl = "func GetTokenExchangeToken" ascii
        $missing_check = "parseJWT" ascii
        $no_db_query = "AddToken" ascii
    condition:
        $func_decl and $missing_check and $no_db_query and not for any of ($db_query*)
}

Sigma Rule

title: Casdoor Token Exchange Without Revocation Check
id: 87654321-4321-4321-4321-210987654321
status: experimental
description: Detects token exchange requests that bypass revocation checks.
author: Valters IT
logsource:
    product: casdoor
    service: token
detection:
    selection:
        event: token_exchange
    condition: selection
falsepositives:
    - Normal token refresh operations.
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-9097 Casdoor Token Exchange Bypass"; flow:to_server; content:"POST"; http_method; content:"/api/token-exchange"; http_uri; content:"token"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Token Exchange: If the token exchange feature is not critical, disable it by removing or commenting out the endpoint in the Casdoor configuration.
2. Implement Custom Middleware: Add a custom middleware that checks the Token table for the subject token's active status before allowing exchange. This can be done by modifying the GetTokenExchangeToken function.
3. Monitor and Audit: Increase logging and monitoring of token exchange events. Set up alerts for any token exchange that occurs after a revocation event.

Long-Term Fix:

• Apply Official Patch: Once the vendor releases a patch, apply it immediately. The patch should add a database lookup to verify token status.
• Upgrade Casdoor: Upgrade to a version that includes the fix (when available).
• Review Token Lifecycle: Ensure that token revocation is properly enforced across all token-related functions.

Workaround Code (Custom Middleware):

func TokenExchangeMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        if r.URL.Path == "/api/token-exchange" {
            // Parse JWT from request
            token := r.FormValue("token")
            claims, err := parseJWT(token)
            if err != nil {
                http.Error(w, "Invalid token", http.StatusBadRequest)
                return
            }

            // Check if subject token is active
            subjectToken, err := GetToken(r.Context(), claims.Subject)
            if err != nil || subjectToken == nil || !subjectToken.IsActive {
                http.Error(w, "Token is not active or revoked", http.StatusForbidden)
                return
            }
        }
        next.ServeHTTP(w, r)
    })
}

Valters IT
DevSecOps & Cyber Threat Intelligence