In affected Casdoor releases, the /api/acs endpoint accepts any well‑formed SAMLResponse without ensuring it is tied to an AuthnRequest the system previously issued. The handler also continues to process responses even after an Identity Provider has been disabled or removed, using a snapshot of the provider taken at request start. Consequently, an attacker who controls a registered IdP can send unsolicited or replayed responses, and Casdoor will create a session for the attacker, allowing persistent unauthorized access to the Casdoor instance.

Casdoor authentication service versions 2.362.0 and earlier are impacted. Systems that integrate Casdoor with SAML should verify the current version and ensure no older releases are deployed.

With a CVSS score of 9.1, the vulnerability is classified as high severity, while an EPSS score of <1% suggests a very low but nonzero probability of exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector is remote delivery of a well‑formed SAMLResponse to /api/acs by an attacker who controls a registered IdP; the absence of request‑link verification allows the attacker to send unsolicited or replayed responses and obtain a persistent session, without needing privileged system access.