CVE-2026-9094

critical · 9.8

Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.

9.8

CVSS

0.4%

EPSS (exploit prob.)

36th

EPSS percentile

2026-05-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://kb.cert.org/vuls/id/780781

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-9094