GHSA-rgq2-93gj-ffxg

Source

https://github.com/advisories/GHSA-rgq2-93gj-ffxg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rgq2-93gj-ffxg/GHSA-rgq2-93gj-ffxg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rgq2-93gj-ffxg

Aliases

CVE-2026-9096
GO-2026-5899

Published

2026-05-28T18:30:32Z

Modified

2026-07-07T16:11:04Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Casdoor doesn't enforce SAML assertion time bounds

Details

Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.

Database specific

{
    "cwe_ids":  [
        "CWE-613"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-02T18:37:47Z",
    "nvd_published_at":  "2026-05-28T17:16:34Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/casdoor/casdoor

Package

Name: github.com/casdoor/casdoor; View open source insights on deps.dev
Purl: pkg:golang/github.com/casdoor/casdoor

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.1000.1-0.20260321120606-239e8bd69487

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-rgq2-93gj-ffxg/GHSA-rgq2-93gj-ffxg.json"