CVE-2026-9091: Casdoor MFA Bypass in Social Login Binding

Technical summary

The vulnerability exists in the social-login binding flow within controllers/auth.go. The binding-rule code path invokes HandleLoggedIn directly without first calling checkMfaEnable, the function responsible for enforcing MFA policies. This creates a logic gap where users bypass MFA checks entirely during the binding authentication flow. The flaw is specific to the binding code path and does not affect standard authentication routes that properly enforce MFA validation.

Business impact

For organizations using Casdoor as their identity provider, this vulnerability undermines MFA-based security posture. An attacker who gains a user's primary credentials can bypass MFA by using the social login binding flow, compromising account security even when MFA policies are in place. This is particularly concerning for regulated environments where MFA is a mandatory control. The risk extends to any downstream systems relying on Casdoor for authentication and authorization.

Affected systems

Casdoor versions 2.362.0 and earlier are vulnerable. This includes all deployments running these versions, regardless of whether MFA is explicitly configured. The vulnerability affects the social login binding feature specifically; not all authentication methods are impacted equally.

Exploitability

Exploitation requires network access to the Casdoor instance and knowledge of a valid user credential. No authentication is required to trigger the binding flow itself, and no complex interaction is needed—the flaw is automatically triggered when social login binding is used. The CVSS score of 5.3 (Medium) reflects low confidentiality impact and network-accessible attack surface, though the logic flaw is straightforward to exploit once the code path is identified.

Remediation

Organizations should upgrade Casdoor to a version later than 2.362.0 as soon as a patched release becomes available. Until patching is feasible, consider temporarily disabling social login binding or implementing network-level restrictions to limit access to the Casdoor application. Verify the patched version's release notes to confirm that checkMfaEnable is properly invoked in the social login binding code path.

Patch guidance

Monitor the Casdoor project repository and release channels for version 2.362.1 or later. Apply patches promptly to production Casdoor deployments. Test patches in a staging environment first to ensure no disruption to social login workflows. After patching, verify that MFA is properly enforced for all authentication paths by conducting a manual test of the social login binding flow with MFA enabled.

Detection guidance

Log authentication events and identify instances where users authenticate via the social login binding flow without MFA completion. If your Casdoor logs track the code path or function calls, look for HandleLoggedIn invocations that bypass checkMfaEnable. Monitor for successful authentications where the MFA flag is unexpectedly absent or disabled. Correlate social login binding activities with user account compromise incidents to identify potential exploitation.

Why prioritize this

This vulnerability merits prompt attention because it directly undermines a critical security control—multi-factor authentication. Unlike vulnerabilities that require extensive prerequisites, this flaw is trivially exploitable and provides a direct path to account takeover for any user whose primary credential is compromised. The medium CVSS score should not minimize the risk in environments where MFA compliance is mandated by policy or regulation.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible attack vector with low complexity and no privileges required. Confidentiality impact is rated low because the attacker gains unauthorized access but does not directly exfiltrate data—the data exposure depends on what the compromised account can access downstream. Integrity and availability impacts are not factored into this score, though an attacker with access may modify data or disrupt services depending on the account's permissions.

Frequently asked questions