CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2024-41657
High (8.8) in casbin casdoor. EPSS 0.8% chance of exploitation in the next 30 days.
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-697, CWE-942
- Published
- Modified
- Record from
- the NVD, synced
Affected
- casbin:casdoor
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mchx-7j67-8mcf | Go | github.com/casdoor/casdoor | <=1.557.0 | no fix published |
| GO-2024-3087 | Go | github.com/casdoor/casdoor | all versions | no fix published |