Casdoor versions up to 2.362.0 validate JSON Web Tokens for signature and claims but do not verify whether the token being exchanged has been revoked in the Token table. The GetTokenExchangeToken() function therefore allows an attacker who possesses a valid JWT to obtain a new token even after an administrator has revoked or invalidated the original token, enabling continued access after a session should have been terminated.

The vulnerability applies to all releases of Casdoor by Casdoor through version 2.362.0 inclusive. Any deployment that uses the token exchange endpoint in those versions is susceptible, with no particular edition or component excluded.

The EPSS score of less than 1% indicates that the exploitation likelihood is low at present, yet the CVSS rating of 9.8 signals a critical severity if the vulnerability is exploited. The issue is not listed in the CISA KEV catalog, so no evidence of active exploitation is documented. Exploitation requires possessing a valid JWT and accessing the exposed token exchange endpoint; once the token is exchanged, the attacker can maintain authenticated access without triggering revocation checks.