Casdoor CVE-2026-9097

Exploitation requires the attacker to (1) possess a cryptographically valid JWT previously issued by the target Casdoor instance whose signature still verifies under a current signing key, and (2) reach the OAuth 2.0 token exchange endpoint that invokes GetTokenExchangeToken() in object/token_oauth.go. No interactive user consent, no administrative privileges, and no special non-default configuration are required on the Casdoor side - the missing revocation check is present in the default code path of versions ≤2.362.0. The principal limiting factor is the JWT-possession prerequisite: the flaw extends the usable lifetime of already-issued tokens rather than enabling token forgery from nothing, so an attacker without any prior token foothold cannot exploit this in isolation. Network reachability to the Casdoor token endpoint is assumed (matching CVSS AV:N).

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H scores 9.8 and asserts network reachability, no privileges, and no user interaction - appropriate for an IAM token endpoint, but exploitation in practice still requires the attacker to first obtain a validly signed JWT (e.g., through earlier theft, leak, or a previously-issued-but-now-revoked token). EPSS is 0.02% at the 5th percentile and the CVE is NOT on CISA KEV, indicating no observed mass exploitation; no public exploit is identified at time of analysis. The SSVC dimensions are not provided in the input, but the technical impact is high for environments that rely on Casdoor for SSO/federation, because administrators lose the ability to terminate sessions after credential compromise - a control failure that is most damaging during incident response. Net: this is a meaningful priority for any production Casdoor deployment, though urgency is moderated by the lack of observed exploitation and the precondition of possessing a valid JWT.

An attacker obtains a valid Casdoor-issued JWT - for example, from a logged browser session, a leaked CI secret, or a token issued to an employee who has since left and whose account was administratively revoked. The attacker submits this JWT to the OAuth token exchange endpoint as a subject_token; because GetTokenExchangeToken() never consults the Token table, the revoked credential is treated as live and a fresh access token is minted, granting continued access to downstream applications federated through Casdoor. No public POC is identified at this time.