CVE-2026-9093

criticalCVSS 9.8covered by 1 sourcefirst seen 2026-05-28

In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.

⚡ Watch CVE-2026-9093

Get an email if CVE-2026-9093 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.

Advisory coverage (1)

criticalGHSA-3w4h-g9f5-j84p: Casdoor does not validate the AudienceRestriction element in SAML assertionsghsa · 2026-05-28

External references

NVD record for CVE-2026-9093

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-9093 status](https://www.csirts.com/badge/CVE-2026-9093)](https://www.csirts.com/cve/CVE-2026-9093)