CVE-2026-9095
HighSummary
In Casdoor versions 2.362.0 and earlier, SAML assertions are mapped to user sessions without replay protection. The ParseSamlResponse() function does not implement replay detection mechanisms, allowing attackers to reuse captured SAML assertions.
Risk Assessment
An attacker can gain access to a user's session, including administrator accounts, without needing the user's password or MFA credentials, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to a newer version of Casdoor that implements appropriate mechanisms for protecting against SAML assertion replay.
Original NVD description (English source)
Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.