CVE-2026-90942

Casdoor uses a private signing key as proof that a user’s access pass is genuine. In affected versions, an organization administrator can retrieve that key and create convincing passes for any user, like getting the master stamp used to approve every badge in the building.

This matters to you if you run Casdoor 4.4.0 or earlier, especially if it manages sign-in or access for multiple organizations. It can affect every organization on the same Casdoor installation. It is only a risk if an attacker already has an organization administrator login.

There is no confirmed public exploitation and no public exploit code on record, but the potential impact is severe because a successful attacker can impersonate high-privilege users across the installation. Treat this as an amber priority: restrict administrator access and the affected endpoints now, then apply the vendor fix when one is available.

Confirm the deployed Casdoor version and determine whether /api/get-certs or /api/get-cert are reachable by organization administrator accounts. All releases through 4.4.0 are affected; no fixed version or supported branch target has been published.

Until a vendor update is available, restrict these endpoints at the reverse proxy or network layer to only the smallest trusted administrator group, remove unnecessary organization administrator accounts, and review authentication controls for the remaining accounts. If there is evidence the private key was retrieved, treat it as a credential compromise: rotate the instance-wide built-in certificate private key using Casdoor-supported procedures, invalidate affected sessions or tokens where possible, and investigate for forged tokens or unexpected privilege changes.

Monitor web and application logs for requests to /api/get-certs and /api/get-cert, unusual organization-administrator logins, unexpected global-administrator activity, and token use inconsistent with normal users. CISA has not added this CVE to KEV, so there is no CISA remediation due date.

CVSS 3.1 is 9.6 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). The issue is CWE-863: insufficient authorization on /api/get-certs and /api/get-cert exposes the instance-wide built-in certificate private key to organization administrators. That key can be used to forge JWTs for arbitrary users and global administrators, creating cross-organization impact. CISA KEV does not list this CVE, no public exploit code is on record, and EPSS is 0.2% (12th percentile) with a flat trend.