CVE-2026-5467
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was identified in Casdoor 2.356.0 in the OAuth Authorization Request Handler. Manipulation of the redirect_uri argument leads to an open redirect. The attack can be performed remotely and the exploit is publicly available.
Risk Assessment
Open redirect can be used for phishing or redirecting users to malicious sites, threatening organizational security.
Recommendation
Update Casdoor to the latest version that fixes this vulnerability or apply proper filters on the redirect_uri parameter.
Original NVD description (English source)
A vulnerability was identified in Casdoor 2.356.0. Affected by this issue is some unknown functionality of the component OAuth Authorization Request Handler. Such manipulation of the argument redirect_uri leads to open redirect. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.