CVE-2026-90942
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
Zayıflık
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
Kaynaklar
- https://github.com/casdoor/casdoor
- https://github.com/casdoor/casdoor/blob/v4.4.0/controllers/cert.go
- https://github.com/casdoor/casdoor/blob/v4.4.0/object/cert.go
- https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-3-organization-admin-can-read-the-global-built-in-jwt-signing-private-key-via-apiget-certs-and-apiget-cert-incomplete-fix-of-3003--enables-cross-organization-token-forgery
- https://www.vulncheck.com/advisories/casdoor-through-4.4.0-private-key-exposure-via-certificate-endpoints
Açığı bir saldırgandan önce siz bulun.
GitHub ile giriş yapın ve ilk denetiminizi bir dakikadan kısa sürede başlatın. Ücretsiz plan için kredi kartı gerekmez.