CVE-2026-9093: Casdoor does not validate the AudienceRestriction element in SAML assertions

May 28, 2026 (updated July 2, 2026)

In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.

References

github.com/advisories/GHSA-3w4h-g9f5-j84p
kb.cert.org/vuls/id/780781
nvd.nist.gov/vuln/detail/CVE-2026-9093

Code Behaviors & Features

Detect and mitigate CVE-2026-9093 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →