{"action":"Upgrade github.com/casdoor/casdoor to 2.387.0 or later.","affected":[{"fixed":"2.387.0","introduced":"0"}],"component":"github.com/casdoor/casdoor","cve_ids":["CVE-2026-9094"],"ecosystem":"Go","epss":0.0042,"exploited":false,"fixed_versions":["2.387.0"],"ghsa_id":"GHSA-c9w5-qp6m-m395","id":"tcs_01M5KF746TB19K0GV92G2E6J00","modified_at":"2026-07-21T19:19:17.248123151Z","published_at":"2026-05-28T18:30:32Z","references":["https://osv.dev/vulnerability/GHSA-c9w5-qp6m-m395","https://nvd.nist.gov/vuln/detail/CVE-2026-9094","https://github.com/casdoor/casdoor/commit/d92b8568686d","https://github.com/casdoor/casdoor","https://kb.cert.org/vuls/id/780781"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-c9w5-qp6m-m395","url":"https://osv.dev/vulnerability/GHSA-c9w5-qp6m-m395"}],"summary":"Casdoor: GetTokenExchangeToken bypass through lack of cross-organization JWT signature check"}