CVE-2026-9094 — CVE-2026-9094
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JW…
Published: 2026-05-28 · CVSS: 9.8 · CVSS 3.1
Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token's user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7