CVE-2026-90942: Casdoor Information Disclosure Vulnerability

CVE-2026-90942 Overview

Casdoor through version 4.4.0 exposes the instance-wide built-in certificate private key through its /api/get-certs and /api/get-cert endpoints. The application fails to mask sensitive key material before returning certificate objects to organization administrators. Any organization administrator with access to these endpoints can retrieve the global JSON Web Token (JWT) signing key. With the private key in hand, an attacker can forge JWT tokens that impersonate any user in any organization, including global administrators. This flaw is tracked as a broken authorization issue [CWE-863] and represents an incomplete fix of a prior disclosure (issue #3003) affecting the same certificate endpoints.

Critical Impact
Cross-organization token forgery enables full authentication bypass and privilege escalation to global administrator across every tenant on the affected Casdoor instance.

Affected Products

Casdoor identity and access management platform
All Casdoor releases through version 4.4.0
Deployments exposing /api/get-certs and /api/get-cert endpoints to organization administrators

Discovery Timeline

2026-09-14 - CVE-2026-90942 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90942

Vulnerability Analysis

Casdoor is an open-source identity and access management (IAM) platform that issues JWTs signed with an instance-wide built-in certificate. The certificate object stored in Casdoor contains both the public certificate and the corresponding RSA private key used to sign every JWT the platform issues.

The /api/get-certs and /api/get-cert endpoints in controllers/cert.go return certificate records to authenticated users with organization administrator privileges. The response serializer does not strip or mask the private key field before sending the object to the client. An organization administrator, who should only manage users and settings within a single tenant, receives the global signing key used across the entire deployment.

Once an attacker holds the private key, they can mint arbitrary JWTs that pass Casdoor's signature verification. Forged tokens can assert any user identity, any organization membership, and any role, including the global administrator role. Every downstream application that trusts Casdoor-issued JWTs also trusts the forged tokens, extending the impact beyond Casdoor itself.

Root Cause

The root cause is a missing authorization and data-masking step in the certificate retrieval handlers. The object/cert.go model exposes the private key field, and the controller returns the full struct without sanitization. This is described in the referenced analysis as an incomplete fix of prior issue #3003, which addressed the same endpoints but did not remove all paths that leak the private key to non-global administrators.

Attack Vector

Exploitation requires network access to the Casdoor API and valid organization administrator credentials. The attacker calls /api/get-certs or /api/get-cert, extracts the private key from the JSON response, and uses it offline to sign forged JWTs. No user interaction is required, and no additional privileges beyond organization administrator are needed to reach the vulnerable endpoints.

See the GitHub Security Finding Analysis and the VulnCheck Advisory for Casdoor for the full technical write-up.

Detection Methods for CVE-2026-90942

Indicators of Compromise

HTTP requests to /api/get-certs or /api/get-cert originating from organization administrator sessions that do not correspond to legitimate certificate management workflows
JWTs presented to downstream services that assert cross-organization membership or elevated roles inconsistent with the issuing user's actual profile in Casdoor
Sudden appearance of authenticated sessions for global administrator accounts without a corresponding interactive login event

Detection Strategies

Enable API access logging on the Casdoor deployment and alert on any read of /api/get-cert* endpoints outside of an approved change window
Correlate JWT sub, owner, and roles claims presented at protected services against the account that authenticated to Casdoor to identify identity mismatches
Track issuance patterns for JWTs signed by the built-in certificate and flag tokens whose iat timestamps do not align with a recorded Casdoor login event

Monitoring Recommendations

Forward Casdoor application logs, reverse proxy access logs, and downstream service authentication logs to a centralized analytics platform for cross-source correlation
Monitor administrative role assignments and organization membership changes for anomalies that could indicate token forgery
Alert on any use of the built-in certificate outside of Casdoor's own signing operations, including exports and downloads

How to Mitigate CVE-2026-90942

Immediate Actions Required

Restrict network access to the Casdoor administrative API so that only trusted operators can reach /api/get-certs and /api/get-cert
Rotate the built-in JWT signing certificate and private key, and invalidate all outstanding JWTs issued by the previous key
Audit organization administrator accounts, remove unnecessary privileges, and reset credentials for any account with recent access to the certificate endpoints
Review authentication and authorization logs across downstream services for evidence of forged tokens issued before rotation

Patch Information

At the time of publication, the enriched CVE data does not list a fixed Casdoor release. Monitor the GitHub Casdoor Repository and the VulnCheck Advisory for Casdoor for a patched version and upgrade as soon as it is available. Review the vulnerable handlers in controllers/cert.go and object/cert.go to confirm the fix removes the private key from responses returned to organization administrators.

Workarounds

Place the Casdoor admin API behind a reverse proxy or web application firewall that blocks requests to /api/get-cert and /api/get-certs from non-approved source addresses
Reduce organization administrator counts to the minimum required and require multi-factor authentication for those accounts
Consider issuing a per-organization signing certificate where supported, and stop relying on the instance-wide built-in certificate for trust decisions in downstream applications
Shorten JWT lifetimes and enforce audience and issuer validation at every relying party to limit the value of a forged token

bash

# Example reverse proxy rule to block access to the vulnerable endpoints
# NGINX configuration snippet
location ~* ^/api/get-certs?$ {
    allow 10.0.0.0/24;    # trusted admin subnet
    deny  all;
    proxy_pass http://casdoor_upstream;
}