GHSA-339W-3HQM-9PJC Casdoor doesn't verify that a JWT used for token exchange is still active

Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExchangeToken function in object/tokenoauth.go validates the JWT signature and parses its claims, but never queries the Token table to verify whether the subject token has been revok...