CVE-2026-9095

Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.

• CWE-294

• https://kb.cert.org/vuls/id/780781

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9089The ConnectWise Automate™ Agent does not fully verify the au…8.8
• CVE-2026-9090Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
• CVE-2026-9091Casdoor versions 2.362.0 and earlier contain a logic flaw in…5.3
• CVE-2026-9092Casdoor versions 2.362.0 and earlier contain a vulnerability…9.1
• CVE-2026-9093In Casdoor versions 2.362.0 and earlier, the SAML service pr…9.8
• CVE-2026-9094Casdoor versions 2.362.0 and earlier contain a vulnerability…9.8
• CVE-2026-9096Casdoor versions 2.362.0 and earlier do not enforce SAML ass…7.5
• CVE-2026-9097Casdoor versions 2.362.0 and earlier do not verify that a JW…9.8
• CVE-2026-9098In Casdoor versions 2.362.0 and earlier, the SAML callback h…9.1
• CVE-2026-9099A flaw was found in Keycloak. A missing authorization check …7.7
• CVE-2026-9100The MongoDB C Driver's legacy GridFS API accepts malformed f…6
• CVE-2026-9101Prototype pollution in csv parsing logic during import can l…5.3