Affected by GO-2024-3086 and 14 other vulnerabilities

GO-2024-3086: Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036) in github.com/casdoor/casdoor

GO-2024-3087: Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor

GO-2025-3661: Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor

GO-2025-4026: Casdoor is vulnerable to Improper Authorization in github.com/casdoor/casdoor

GO-2026-5509: Casdoor vulnerable to Open Redirect in github.com/casdoor/casdoor

GO-2026-5535: Casdoor vulnerable to SSRF via crafted Webhook URL in github.com/casdoor/casdoor

GO-2026-5697: Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml in github.com/casdoor/casdoor

GO-2026-5892: Casdoor doesn't verify that a JWT used for token exchange is still active in github.com/casdoor/casdoor

GO-2026-5894: Casdoor does not validate the AudienceRestriction element in SAML assertions in github.com/casdoor/casdoor

GO-2026-5895: Casdoor has an authentication bypass in github.com/casdoor/casdoor

GO-2026-5896: Casdoor allows users to bypass configured MFA requirements in github.com/casdoor/casdoor

GO-2026-5898: Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest in github.com/casdoor/casdoor

GO-2026-5899: Casdoor doesn't enforce SAML assertion time bounds in github.com/casdoor/casdoor

GO-2026-5945: Casdoor: Arbitrary file write possible through Local File System storage provider in github.com/casdoor/casdoor

GO-2026-5953: Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check in github.com/casdoor/casdoor

casdoor

command module

v1.318.0 Latest Latest Go to latest Published: May 19, 2023 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/casdoor/casdoor

Links

README ¶

📦⚡️ Casdoor

A UI-first centralized authentication / Single-Sign-On (SSO) platform based on OAuth 2.0 / OIDC.

GitHub stars

Online demo

Read-only site: https://door.casdoor.com (any modification operation will fail)
Writable site: https://demo.casdoor.com (original data will be restored for every 5 minutes)

Contribute

For casdoor, if you have any questions, you can give Issues, or you can also directly start Pull Requests(but we recommend giving issues first to communicate with the community).

I18n translation

If you are contributing to casdoor, please note that we use Crowdin as translating platform and i18next as translating tool. When you add some words using i18next in the web/ directory, please remember to add what you have added to the web/src/locales/en/data.json file.

License

Apache-2.0

Documentation ¶

There is no documentation for this package.

Source Files ¶

View all Source files

main.go

Directories ¶

Path	Synopsis
ai
authz
captcha
conf
controllers
cred
deployment
form
i18n
idp
ldap
object
pp
proxy
routers Package routers @APIVersion 1.0.0 @Title Casdoor API @Description Documentation of Casdoor API @Contact admin@casbin.org	Package routers @APIVersion 1.0.0 @Title Casdoor API @Description Documentation of Casdoor API @Contact admin@casbin.org
storage
sync
util
xlsx

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

README ¶

📦⚡️ Casdoor

A UI-first centralized authentication / Single-Sign-On (SSO) platform based on OAuth 2.0 / OIDC.

Online demo

Documentation

Install

How to connect to Casdoor?

Casdoor Public API

Integrations