Casdoor versions 2.362.0 and earlier allow attackers to hijack user accounts by submitting email claims that have not been verified by the upstream identity provider. The missing email_verified check means the system trusts any provided email address, enabling an adversary to bind an unverified email to an existing account and assume its identity. This flaw constitutes an access‑control lapse that directly leads to full account takeover with the privileges of the compromised user.

Casdoor Casdoor, releases 2.362.0 and earlier. The vulnerability is specific to the getExistUserByBindingRule function where email matching occurs without verifying the email_verified flag from upstream identity providers.

The flaw can be exploited remotely through the standard identity‑provider integration by supplying a crafted email claim. The CVSS score is 9.1 and the EPSS score is < 1%, indicating a severe vulnerability with a very low but nonzero likelihood of exploitation in environments with active upstream integrations. No patch or workaround is listed in KEV, but the issue remains severe as it allows full control over user accounts.