The vulnerability in Casdoor (CVE-2026-9090) affects versions 2.362.0 and earlier. It allows an attacker to bypass authentication by exploiting improper certificate validation in the SAMLResponse processing. Specifically, the buildSpCertificateStore function does not validate the signing certificate against a trusted Identity Provider certificate but instead uses the certificate extracted directly from the SAMLResponse. This enables attackers to forge signed assertions using their own keys, effectively bypassing authentication controls.

Successful exploitation leads to a complete authentication bypass, allowing attackers to impersonate any user without valid credentials. This compromises confidentiality and integrity of the authentication process, potentially granting unauthorized access to protected resources. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid deploying vulnerable versions in sensitive environments or implement additional controls to validate SAMLResponse certificates against trusted Identity Provider certificates.