CVE-2026-90942

Casdoor, an open-source identity and access management (IAM)/single sign-on platform, through version 4.4.0 incorrectly authorizes organization administrators to read the instance-wide built-in certificate private key via the /api/get-certs and /api/get-cert endpoints. A malicious or compromised organization administrator can retrieve that key and then forge validly signed JWT tokens impersonating any user in any organization on the instance, including global administrators, resulting in complete authentication bypass and full takeover of the Casdoor deployment. The flaw is an incorrect authorization issue (CWE-863) rather than a memory-safety or injection bug, and it scores 9.3 (Critical) under CVSS 4.0 because a low-privileged insider gains both high confidentiality and high integrity impact across security scopes. All self-hosted Casdoor instances through 4.4.0 that use the built-in certificate are affected, particularly multi-tenant deployments where organization administrators are semi-trusted users. No public proof-of-concept is known and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known at this time.

What to do: Upgrade Casdoor to a release newer than 4.4.0 as soon as a fixed version is available from the vendor. Because a leaked key cannot be un-leaked, rotate the instance-wide built-in certificate and its private key (and any tokens signed with it) after upgrading. Audit server logs for calls to /api/get-certs and /api/get-cert made by organization administrators, and revoke sessions/tokens for any deployment where such access is unexplained.