Skip to content
Threat Feed
Subscribe

Vendor

Casdoor

2 briefs RSS
high advisory

Authentication Bypass Vulnerability in Casdoor

A missing authentication vulnerability in Casdoor versions up to 3.161.1 allows remote attackers to bypass security controls via the ApiFilter function.

Casdoor
1t 1c
critical advisory

Authorization Bypass Vulnerability in Casdoor /api/mcp Endpoint

Casdoor versions through 4.4.0 contain an authorization bypass vulnerability (CVE-2026-91998) in the /api/mcp endpoint, allowing authenticated attackers to perform unauthorized administrative actions across all organizations.

PoC Casdoor
1r 1c