Casdoor before version 2.362.0 contains a critical vulnerability (CVE-2026-9097) where the GetTokenExchangeToken() function fails to verify if a JWT used for token exchange has been revoked or invalidated. While the JWT signature and claims are validated, the absence of a revocation check against the Token table means that compromised or revoked tokens remain accepted by the system. This undermines session termination and token revocation mechanisms, potentially allowing unauthorized access to protected resources.

Because the system does not check token revocation status, attackers or unauthorized users may continue to use tokens that should have been invalidated. This can lead to unauthorized access, data compromise, and persistence of active sessions that administrators cannot terminate. The vulnerability affects confidentiality, integrity, and availability of the system, as indicated by the CVSS vector (C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be aware that token revocation is ineffective in affected versions. Monitoring for updates from the Casdoor project is recommended to apply any forthcoming patches promptly.