Vulnerability Description
Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/casdoor/casdoor
- https://github.com/casdoor/casdoor/blob/v4.4.0/controllers/cert.go
- https://github.com/casdoor/casdoor/blob/v4.4.0/object/cert.go
- https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-3-organization-admi
- https://www.vulncheck.com/advisories/casdoor-through-4.4.0-private-key-exposure-
FAQ
What is CVE-2026-90942?
CVE-2026-90942 is a vulnerability with a CVSS score of 9.6 (CRITICAL). Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Atta...
How severe is CVE-2026-90942?
CVE-2026-90942 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-90942?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.