Back to search
CVE-2026-9096
Published: May 28, 2026
Modified: Jun 2, 2026
PUBLISHED
Description
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.
| Vendor | Product | Versions |
|---|---|---|
Casdoor | Casdoor | affected 0 - <= 2.362.0 |
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now