| id: GO-2026-5898 | |
| modules: | |
| - module: github.com/casdoor/casdoor | |
| unsupported_versions: | |
| - last_affected: 1.1000.1-0.20260321120606-239e8bd69487 | |
| vulnerable_at: 1.1000.0 | |
| summary: |- | |
| Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to | |
| /api/acs without verifying that it corresponds to an AuthnRequest in github.com/casdoor/casdoor | |
| cves: | |
| - CVE-2026-9098 | |
| ghsas: | |
| - GHSA-mfvp-7p3v-x9mh | |
| references: | |
| - advisory: https://github.com/advisories/GHSA-mfvp-7p3v-x9mh | |
| - advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-9098 | |
| - web: https://kb.cert.org/vuls/id/780781 | |
| source: | |
| id: GHSA-mfvp-7p3v-x9mh | |
| created: 2026-07-06T17:40:27.714203122-04:00 | |
| review_status: UNREVIEWED |