CVE-2026-9091

Casdoor versions 2.362.0 and earlier contain a logic flaw in the social‑login binding flow that allows users to bypass configured MFA requirements. The binding‑rule code path in controllers/auth.go calls HandleLoggedIn directly without invoking checkMfaEnable. Any user authenticating via this pat...

CVE-2026-9091

Casdoor versions 2.362.0 and earlier are vulnerable to a logic flaw in the social-login binding flow that allows users to bypass configured multi-factor authentication (MFA) requirements. The issue resides in the controllers/auth.go file, where the binding-rule code path calls HandleLoggedIn dire...