The vulnerability in Casdoor (<=2.362.0) arises because the SAML callback handler does not verify that incoming SAMLResponse messages correspond to an AuthnRequest previously issued by Casdoor. This lack of correlation enables attackers who control a registered upstream IdP to send unsolicited or replayed SAML responses to the /api/acs endpoint. Furthermore, even if an administrator disables or deletes an IdP after a SAML flow has started, the handler processes responses using a snapshot of the IdP configuration from the start of the request, which can be exploited for unauthorized access. This flaw leads to Casdoor issuing sessions without proper authentication validation, enabling persistent unauthorized access.

An attacker controlling a registered upstream IdP can exploit this vulnerability to gain persistent unauthorized access by sending unsolicited or replayed SAML responses. This bypasses normal authentication flows, allowing the attacker to impersonate users without valid authentication requests. The vulnerability impacts confidentiality and integrity by allowing unauthorized session issuance. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully manage and monitor registered IdPs, avoiding disabling or deleting IdPs during active SAML flows. Consider restricting or auditing upstream IdPs to trusted entities only. Monitor for unusual SAML responses and session creations related to /api/acs.