Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 02:35:30 +0000 EUVD-2026-324055 https://cve.radiocsirt.org/vuln/euvd-2026-324055 EUVD-2026-324055 https://cve.radiocsirt.org/vuln/euvd-2026-324055 fkie_cve-2026-9094 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9094 <p>Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token&#39;s user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.</p> <p>Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token&#39;s user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9094 GHSA-c9w5-qp6m-m395 — Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check https://cve.radiocsirt.org/vuln/ghsa-c9w5-qp6m-m395 <p><strong>Affected:</strong> Go: github.com/casdoor/casdoor</p> <p>Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token&#39;s user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.</p> <p><strong>Affected:</strong> Go: github.com/casdoor/casdoor</p> <p>Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the token&#39;s user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.</p> https://cve.radiocsirt.org/vuln/ghsa-c9w5-qp6m-m395