CVE-2026-9095

Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.

• CWE-294

• https://kb.cert.org/vuls/id/780781

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-90944Krayin CRM through 2.2.6 exposes the POST /admin/mail/inboun…8.2
• CVE-2026-90945Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret f…9.8
• CVE-2026-90946DeepWiki-Open through commit d92819a contains an arbitrary f…7.5
• CVE-2026-90947A flaw was found in GIMP. When processing a specially crafte…7.8
• CVE-2026-90948A flaw was found in GIMP's ICO file loader. When processing …7.8
• CVE-2026-90949A flaw was found in GIMP's PSP (Paint Shop Pro) file loader.…7.8
• CVE-2026-90950The Paid Membership Subscriptions WordPress plugin before 3.…5.3
• CVE-2026-90951The Paid Membership Subscriptions WordPress plugin before 3…3.7
• CVE-2026-90955Affected versions of MISP’s interactive CLI shell do not rel…4.6
• CVE-2026-90957Affected versions of MISP serve uploaded SVG images inline w…5.1
• CVE-2026-90959A path traversal vulnerability was found in pulpcore. The co…8.1
• CVE-2026-9096Casdoor versions 2.362.0 and earlier do not enforce SAML ass…7.5