~ / search / GHSA-rgq2-93gj-ffxg

GHSA-rgq2-93gj-ffxg

Casdoor doesn't enforce SAML assertion time bounds

Source: GitHub Advisory Database (reviewed) High CVE-2026-9096

Packages

EcosystemPackageAffectedFixed in
Go github.com/casdoor/casdoor <= 1.1000.1-0.20260321120606-239e8bd69487 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.

References

External links from the advisory. They lead to third-party sites.