Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this path is logged in without MFA enforcement.
Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.
In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/saml_sp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects WarningInfo.NotInAudience. This allows assertions issued for other service providers to be accepted by Casdoor.
Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken() function in object/token_oauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revoked or invalidated. Because the revocation check is entirely absent, administrators are unable to terminate active sessions or revoke compromised tokens.
Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.
In Casdoor versions 2.362.0 and earlier, the SAML callback handler in controllers/auth.go accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest previously issued by Casdoor. Additionally, if an administrator disables or deletes an IdP (Identity Provider) after a SAML flow has started, the handler still processes the response using the provider snapshot loaded at the start of the request. As a result, an attacker controlling a registered upstream IdP can send unsolicited SAML responses, or replay a legitimately captured response in a different session or after the original flow has ended. In both cases, Casdoor accepts the response and issues a session, enabling persistent unauthorized access.
Mattermost versions 10.11.0 through 10.11.14, 11.4.0 through 11.4.4, 11.5.0 through 11.5.3, and 11.6.0 are vulnerable to a denial of service caused by failure to filter nil elements from outgoing webhook attachment payloads. An authenticated user can send a crafted webhook callback response containing a null attachment entry, which causes the server process to terminate.
Mattermost versions 10.11.0 through 10.11.14, 11.4.0 through 11.4.4, 11.5.0 through 11.5.3, and 11.6.0 are affected by a vulnerability where user-supplied input in API request handlers is not properly validated. This flaw allows an authenticated attacker to crash the plugin process by sending a crafted HTTP request to the pull request details endpoint. The vulnerability has been assigned CVE-2026-4646 and is categorized under CWE-1287.
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
In April 2026, Cato CTRL identified and blocked an attempted intrusion against a global manufacturing customer involving TencShell, a previously undocumented, Go-based implant derived from the open-source Rshell C2 framework. The activity appeared in traffic associated with a third-party user connected to the customer environment.
The slack-go library before version 0.23.1 contains a vulnerability in the SecretsVerifier component where it accepts an empty signing secret without error. This allows an attacker to forge a valid X-Slack-Signature header and bypass Slack request authentication if the application is misconfigured with an empty or unset SLACK_SIGNING_SECRET. The issue is fixed in version 0.23.1, which rejects empty secrets with an explicit error.
in-toto-golang and in-toto-python have inconsistent behavior in how they handle negation in glob patterns for artifact rules. Specifically, in-toto-python uses '!' for negation, while in-toto-golang used '^'. This inconsistency can cause different verification results when both implementations are used in the same pipeline. The issue is fixed in in-toto-golang version 0.11.0, which now uses '!' for negation.
Nhost's authentication system does not revoke existing sessions when a user changes their password, leaving previously issued refresh tokens valid. This affects all password change methods, including authenticated changes and password reset flows. An attacker who has stolen a refresh token can maintain access even after the victim changes their password, undermining the expected session termination. The vulnerability is fixed in version 0.0.0-20260430132514-52c70664a7e9.
Ech0's OAuth redirect URI validation is flawed because it only compares the scheme and host of redirect URIs against an allowlist, ignoring the path, query, and fragment components. This allows an attacker to craft a redirect URI with an allowed host but an attacker-controlled path, enabling theft of the OAuth exchange code. The attacker can then exchange this code for the victim's access and refresh tokens. This vulnerability violates RFC 6749 §3.1.2, which requires exact redirect URI matching. A fix is available in version 1.4.8-0.20260503040728-a7e8b8e84bd1.
Ech0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchPeerConnectInfo function, which uses an unsafe HTTP request method without URL validation. Authenticated users can exploit this to make the server request arbitrary URLs, including internal and cloud metadata endpoints such as AWS instance metadata and Kubernetes API endpoints. This vulnerability affects versions prior to 1.4.8-0.20260503040602-091d26d2d942 and has a high severity rating.
The Ech0 application exposes a PUT endpoint /api/echo/like/:id that allows unauthenticated users to increment the favorite count (fav_count) of any echo, including private ones, without rate limiting or deduplication. This flaw enables anonymous actors to manipulate popularity metrics, bypass private echo boundaries, and cause increased load on the database and cache layers. The vulnerability exists because the like endpoint is registered on a public router group without authentication or rate limiting, unlike other endpoints that enforce such controls. A fix is available in version 1.4.8-0.20260503035905-cecc2c19b590.
The Ech0 application exposes a public API endpoint for liking content that does not require authentication. This allows any remote client to increment the like count arbitrarily by sending repeated unauthenticated requests. The vulnerability undermines the integrity of engagement metrics, enabling attackers to inflate like counts and distort social proof. The flaw affects versions prior to 1.4.8-0.20260503040728-a7e8b8e84bd1. A fix is available in version 1.4.8-0.20260503040728-a7e8b8e84bd1.
Ech0 versions prior to 1.4.8-0.20260503035519-fd320fe3e902 contain a stored cross-site scripting (XSS) vulnerability in their public RSS/Atom feed. The feed renders attacker-controlled tag names and Markdown content without proper HTML escaping, allowing injected script tags to execute in RSS readers that render HTML. This vulnerability requires admin privileges to create malicious content and affects subscribers who consume the RSS feed. A fix is available in version 1.4.8-0.20260503035519-fd320fe3e902.
The Ech0 comment model exposes guest commenters' email addresses via unauthenticated public API endpoints (/api/comments and /api/comments/public). The Email field is serialized in API responses despite developer intent to keep PII private, allowing any anonymous user to harvest all guest commenter emails. This violates user privacy expectations and data protection regulations such as GDPR and CCPA. The issue affects version prior to 1.4.8-0.20260503034700-cb8d7a997dd8 and has been fixed in that release.
FileBrowser Quantum version v1.3.0-stable is vulnerable to stored cross-site scripting (XSS) via SVG files served through public share links without a Content-Security-Policy (CSP) header. This allows embedded JavaScript in SVG files to execute in the browser of anyone accessing the public share link with inline rendering enabled. The vulnerability can lead to session hijacking and phishing attacks without requiring authentication. A fix is available that adds a CSP header to block script execution in inline SVG files.