The vulnerability originates in the CasP3ProxyValidate function within Casdoor's controllers/cas.go. It is classified as CWE-918. An attacker can modify the pgtUrl parameter sent to that endpoint, causing the application to issue arbitrary HTTP requests to internal or external resources. This server‑side request forgery can enable the attacker to exfiltrate network information, access protected internal systems, or launch further attacks against other services. The CVSS score of 5.3 indicates a moderate severity.

Casdoor installations running any version up to 3.164.0 or 4.10.0 are impacted. The fix is incorporated in release 4.11.0, based on commit 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9. No other vendors are currently affected.

The EPSS score is not available, and Casdoor has not been listed in the CISA KEV catalog, suggesting that mass exploitation has not yet been documented. Nevertheless, the SSRF exploit can be performed remotely by interacting with the publicly exposed proxy validation endpoint. Given the moderate CVSS rating and lack of widespread exploitation indicators, the overall risk is moderate but it is advisable to patch promptly to eliminate the potential for internal reconnaissance and data exfiltration.