QSearchQSearch

CVE-2026-9092

9.1 CRITICAL

Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover

Published: 2026-05-28 · Last updated: 2026-06-01

Severity and scoring

CVSS
9.1 CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Casdoor versions 2.362.0 and earlier contain a vulnerability involving unverified email binding that may enable account takeover. The getExistUserByBindingRule function matches users by email without checking the email_verified claim from upstream providers; the idp.UserInfo struct does not even include a EmailVerified field. An attacker can supply an unverified email claim from an upstream provider to take over accounts that use the same email address.

Source: NVD

References