CVE-2026-9095: Casdoor SAML Replay Attack Allows Authentication Bypass

Technical summary

The vulnerability exists in Casdoor's SAML Service Provider implementation, specifically in the ParseSamlResponse() function within object/saml_sp.go. The code calls sp.RetrieveAssertionInfo() to extract claims from an incoming SAML assertion and immediately maps the result to an authenticated user session. The SAML SP code path lacks three critical security controls: (1) no assertion ID caching mechanism to track processed assertions, (2) no enforcement of the OneTimeUse condition that SAML allows issuers to set on assertions, and (3) no replay detection or timestamp validation beyond what the identity provider may have included. This maps to CWE-294 (Authentication Using a Trusted Channel When the Channel Cannot be Authenticated), as the application trusts the assertion content without verifying freshness or uniqueness. Affected versions are Casdoor 2.362.0 and earlier.

Business impact

Organizations using Casdoor for federated identity management face unauthorized account takeover risk. An attacker with network access to capture SAML traffic, or with access to Casdoor logs or backups containing assertion data, can impersonate any user indefinitely. For deployments where Casdoor manages administrator or privileged service accounts, this translates to potential full compromise of systems managed through that Casdoor instance. Incident response is complicated because traditional password resets do not invalidate captured assertions; attackers retain access unless assertion-specific defenses are deployed or sessions are forcibly terminated.

Affected systems

Casdoor versions 2.362.0 and earlier are affected. The vulnerability affects all Casdoor deployments using SAML as an authentication method, regardless of the upstream SAML identity provider (e.g., Okta, Entra ID, Keycloak). Environments where Casdoor is integrated into applications or services for SSO are at risk. Self-hosted and on-premises deployments are included; cloud-hosted instances depend on whether the operator has upgraded.

Exploitability

Exploitation requires an attacker to obtain a valid SAML assertion. This can occur through several means: passive network interception in an environment without encrypted SAML transport, compromise of an identity provider, extraction from application logs or database backups, or social engineering of a user to forward their login credentials or session tokens. Once an assertion is captured, no additional technical barriers prevent its replay. The CVSS score of 8.1 (HIGH) reflects high impact (complete authentication bypass for a targeted account) tempered by the requirement to obtain a valid assertion first, which is feasible in many enterprise environments but not trivial for external attackers. Active exploitation is not yet documented in public disclosures, but the attack is straightforward to execute.

Remediation

Upgrade Casdoor to a version that enforces SAML replay protection. Verify with the Casdoor project's security advisories for the first patched version. Pending patching, implement compensating controls: enforce HTTPS/TLS for all SAML traffic to reduce interception risk, restrict SAML assertion lifetime to minutes (typically a configuration in your identity provider), enable detailed logging of SAML assertions and session creation, and monitor for suspicious patterns such as multiple successful logins from the same assertion or logins occurring outside normal business hours. Consider temporarily disabling SAML authentication if you cannot patch and rely on alternative authentication methods.

Patch guidance

Check the Casdoor GitHub repository (github.com/casdoor/casdoor) and security advisories for a release version later than 2.362.0 that addresses assertion replay protection. The fix should include assertion ID caching, OneTimeUse condition validation, and timestamp-based replay detection. Upgrade the Casdoor service, verify the new version is in production, and test SAML login flows to confirm functionality is preserved. After patching, consider rotating or invalidating long-lived SAML assertions if your identity provider allows it.

Detection guidance

In Casdoor logs, search for repeated successful authentications using the same SAML assertion ID or with the same assertion content but separated by unusual time intervals. If your identity provider logs SAML assertion issuance, correlate with Casdoor session creation logs to identify assertions used multiple times or used after their stated expiration. Deploy network-level monitoring to detect SAML assertion patterns consistent with replay (e.g., identical encrypted SAML responses sent to Casdoor). Alert on administrator or privileged account logins that lack corresponding identity provider records or that occur outside normal patterns. Review Casdoor session tables for sessions created by the same principal within short timeframes, which may indicate replay.

Why prioritize this

This vulnerability merits immediate attention for any organization using Casdoor with SAML authentication. The combination of high impact (complete account takeover, potentially of privileged users) and moderate exploitability (requires assertion capture but no advanced techniques) places it in the highest priority tier. Unlike many authentication bypass flaws that require social engineering or zero-days, this can be exploited against any captured assertion with no further interaction. The lack of an active patch at publication means organizations must evaluate their risk posture and defensive layers now.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (A) Attack Vector Network—the assertion can be replayed over any network path, (B) Attack Complexity High—the attacker must first obtain a valid assertion, which requires interception or provider compromise, (C) Privileges Required None—no special access is needed once the assertion is obtained, (D) User Interaction None—no user action is required to perform the attack, (E) Scope Unchanged—the impact is limited to the Casdoor application and authenticated resources, (F) Confidentiality Impact High—attackers gain access to sensitive data as the authenticated user, (G) Integrity Impact High—attackers can modify data and configuration as that user, (H) Availability Impact High—attackers can delete or disable resources. The score balances the severe impact against the practical requirement to intercept or acquire an assertion.

Frequently asked questions