Casdoor’s SAML service provider implementation fails to validate the AudienceRestriction element in SAML assertions. Because the buildSp function never sets the AudienceURI or examines WarningInfo.NotInAudience, assertions issued for other service providers are accepted without question. This flaw allows an attacker to forge or replay SAML assertions designed for a different target, potentially obtaining unauthorized access to Casdoor‑managed resources or impersonating legitimate users.

The vulnerability affects the Casdoor application, specifically versions 2.362.0 and earlier. All deployments of Casdoor within that version range that rely on the SAML service provider component are potentially exposed.

The EPSS score of 0.00017 indicates a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The impact of accepting unauthorized assertions is significant. The CVSS base score is 9.8, indicating critical severity. An attacker could exploit the flaw by presenting a crafted SAML assertion to the Casdoor endpoint, bypassing the intended audience check. While the low EPSS score suggests that exploitation events are rare, any Casdoor deployment with a reachable SAML endpoint remains susceptible to this remote attack.