9.8 Critical
CVE-2026-9094
CVE-2026-9094
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 41% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
Coverage 1 article · 1 outlet
- Severe Casdoor Identity Platform Flaws Expose Corporate NetworksSecurityOnline · first in our coverage · mentions it in passing