CVE-2026-105307: Casdoor Authentication Bypass Vulnerability

CVE-2026-105307 Overview

CVE-2026-105307 is a missing authentication vulnerability [CWE-287] in Casdoor, an open-source identity and access management platform. The flaw affects the ApiFilter function in routers/authz_filter.go, which is part of the API Endpoint component. Attackers can manipulate requests remotely to bypass authentication controls on affected API routes. The issue impacts Casdoor versions up to and including 3.161.1. Public exploit details have been disclosed, increasing the likelihood of opportunistic abuse. According to VulDB, the vendor was contacted prior to public disclosure but did not respond.

Critical Impact

Remote, unauthenticated attackers can reach API endpoints that should require authentication, exposing identity data and administrative functions.

Affected Products

• Casdoor versions up to 3.161.1
• Deployments using the ApiFilter authorization filter in routers/authz_filter.go
• Self-hosted Casdoor identity provider instances exposed over the network

Discovery Timeline

• 2026-10-05 - CVE-2026-105307 published to the National Vulnerability Database (NVD)
• 2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-105307

Vulnerability Analysis

Casdoor relies on the ApiFilter function in routers/authz_filter.go to enforce authentication and authorization decisions on incoming API requests. The vulnerability stems from an authentication check that is missing or incorrectly applied, allowing requests to pass through the filter without a valid session or credential. Because Casdoor is a central identity provider, bypassing this filter can expose user records, organization settings, and OAuth or SAML configuration endpoints.

The attack requires only network reachability to the Casdoor service. No user interaction and no prior authentication are required. VulDB reports that exploit material is public, which lowers the barrier to abuse.

Root Cause

The root cause is improper enforcement of authentication within ApiFilter. The filter does not consistently reject requests that lack a valid session, token, or authorization context before forwarding them to downstream handlers. This matches the pattern defined by [CWE-287: Improper Authentication].

Attack Vector

An attacker sends crafted HTTP requests directly to affected Casdoor API endpoints. Because ApiFilter fails to block unauthenticated callers, the backend processes the request as if it originated from an authorized principal. This can be used to read or modify identity-related resources depending on the endpoint reached. Specific exploitation details are published on VulDB rather than reproduced here. See the VulDB CVE-2026-105307 record for technical details.

Detection Methods for CVE-2026-105307

Indicators of Compromise

• Unauthenticated HTTP requests to Casdoor API routes that return 200 OK instead of 401 Unauthorized or 403 Forbidden.
• Access log entries for sensitive endpoints under /api/ without a preceding valid session or bearer token.
• Unexpected reads or modifications of user, role, or application objects outside of normal administrative activity.

Detection Strategies

• Audit Casdoor access logs for API calls that lack an Authorization header or session cookie but still produce successful responses.
• Compare request patterns against known administrative IP ranges and flag deviations.
• Correlate Casdoor API activity with downstream identity events, such as new OAuth clients or modified user records.

Monitoring Recommendations

• Forward Casdoor application logs and reverse-proxy logs to a centralized SIEM or data lake for retention and query.
• Alert on spikes in 4xx-to-2xx ratio changes on /api/ paths, which may indicate successful bypass attempts.
• Monitor for scanning behavior targeting routers/authz_filter.go-protected endpoints from a single source.

How to Mitigate CVE-2026-105307

Immediate Actions Required

• Restrict network exposure of Casdoor administrative API endpoints to trusted networks or a VPN.
• Place Casdoor behind a reverse proxy that enforces authentication at the edge until a patch is applied.
• Rotate credentials, API keys, and OAuth client secrets managed by affected Casdoor instances if exposure is suspected.
• Review audit logs for unauthorized changes to users, roles, applications, and tokens.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry, and VulDB notes the vendor did not respond to the disclosure. Monitor the Casdoor project for updates that modify routers/authz_filter.go and the ApiFilter function. Upgrade to a release above 3.161.1 once a fix is published.

Workarounds

• Enforce authentication at an upstream gateway, such as an API gateway or reverse proxy, so unauthenticated requests cannot reach Casdoor directly.
• Apply firewall rules that allow API traffic only from known application servers and administrative hosts.
• Disable or firewall off unused API endpoints to reduce the exposed surface until an official fix is available.

# Example nginx reverse-proxy snippet enforcing an auth header before Casdoor
location /api/ {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://casdoor_upstream;
}