CVE-2026-9090

CRITICAL

Casdoor SAML Authentication Bypass via Arbitrary Signing Certificate

Generated titleSource: EIP title enrichment
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-9090 has a selected CVSS score of 9.1 (critical); EIP currently links 1 repository PoC.

Description

Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary signing certificate. The buildSpCertificateStore function extracts the X.509 certificate directly from the incoming SAMLResponse instead of using the trusted pre-configured Identity Provider certificate, allowing an attacker to forge assertions signed with an attacker-controlled key.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 29, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Casdoor

Browse Casdoor / Casdoor
CVE ListThrough 2.362.0affected

github.com/casdoor/casdoor

Browse Go / github.com/casdoor/casdoor
GitHub AdvisoryThrough 1.1000.1-0.20260321120606-239e8bd69487affected

Proofs of concept

1

Repository PoCs

GitHubGeorge0Papasotiriou/CVE-2026-9090-Modbus-TCP-Write-to-Read-Only-Coils-via-Function-Code-SpoofingRepository PoCby George0Papasotiriou0Exploit4 files

4.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains a Python script (exploit_modbus_write.py) that uses pymodbus to write to a coil on a simulated Modbus TCP server, intended to demonstrate unauthorized modification of read-only coils. A companion script (modbus_plc_sim.py) simulates the vulnerable server.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for a Modbus TCP vulnerability. The README describes a configuration error allowing writes to read-only coils, and the exploit script demonstrates a legitimate proof-of-concept write to a coil. No backdoor, concealed executable behavior, or operator-directed harm is present in the reviewed text.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareModbus TCP Serverpymodbus
Attack typesInsufficient Access ControlProtocol Manipulation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The file exploit_modbus_write.py is explicitly named as an exploit and contains code that actively sends a write command to a coil intended to be read-only, exercising the described vulnerability.

exploit_modbus_write.py:1-9README.md:41-48

Requirements

  • A running instance of the simulated Modbus TCP server (modbus_plc_sim.py) on localhost port 5020.README.md:42-45
  • The pymodbus Python library must be installed.README.md:44

Observed behavior

  • Connects to a Modbus TCP server at 127.0.0.1:5020 and sends a write command to coil 0, setting its value to False.exploit_modbus_write.py:4-7
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
CVE-2026-9090 is described as a Casdoor SAML authentication bypass, but the repository content describes a Modbus TCP write-to-read-only-coils vulnerability.The CVE metadata associated with the artifact does not match the vulnerability described in the repository files. This discrepancy is noted but does not constitute backdoor behavior within the artifact itself.README.md:4README.md:34
Review boundaries

What the analysis did not establish

  • The artifact's CVE context (CVE-2026-9090) describes a Casdoor SAML authentication bypass, which is unrelated to the Modbus TCP content in the repository files. This discrepancy suggests the repository may be mislabeled or the CVE association is incorrect.
  • The simulated server script (modbus_plc_sim.py) is only partially shown in README.md; the complete file is not provided in the selected text, limiting full verification of the vulnerable configuration.
  • The analysis is based solely on static code review; the code was not executed, and its actual behavior is not confirmed.
  • Two text files (total 4 files) were omitted from the packet content and were not reviewed.
  • Binary content was not analyzed; the packet policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED.
  • The review is limited to the supplied evidence and does not assess the correctness or safety of the vulnerability demonstration.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3