https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T11:20:02.457334+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-322500 EUVD-2026-322500 2026-10-09T11:20:02.529484+00:00 EUVD-2026-322500 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9095 fkie_cve-2026-9095 2026-10-09T11:20:02.529529+00:00

Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.

 https://cve.radiocsirt.org/vuln/ghsa-jcmp-phfm-38x8 GHSA-jcmp-phfm-38x8 2026-10-09T11:20:02.529584+00:00

Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse() function in object/saml_sp.go calls sp.RetrieveAssertionInfo() and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcement, or replay detection anywhere in the SAML SP code path. As a result, an attacker can replay a previously captured SAML assertion to obtain an authenticated session for the assertion’s subject, including administrator accounts, without needing the user’s password or MFA credentials.