Casdoor <= 4.4.0 Vulnerability: Critical CVE-2026-90942 Alert
- Severity
- CRITICAL
- CVSS
- 9.6
- Affected component
- casdoor (npm)
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in Casdoor <= 4.4.0 that may expose the instance-wide built-in certificate private key.
What happened
An early warning has been issued for a critical vulnerability in Casdoor <= 4.4.0. The vulnerability, tracked as CVE-2026-90942, involves the improper masking of the instance-wide built-in certificate private key in the /api/get-certs and /api/get-cert endpoints. This could allow organization administrators to retrieve the private key. Attackers who obtain the private key may be able to forge JWT tokens for any user in any organization, including global administrators.
The vulnerability was first flagged on 2026-09-14T18:20:28.720000+00:00. It is currently under investigation and has not been confirmed as exploited in the wild. Users of Casdoor <= 4.4.0 should assess their exposure and take immediate action to mitigate the risk.
What to do about it
- Check your Casdoor version. If you are using version 4.4.0 or earlier, you are potentially affected.
- Upgrade to a version of Casdoor that properly masks the instance-wide built-in certificate private key.
- Revoke and regenerate any compromised JWT tokens.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
- Consider implementing additional security measures to protect your JWT tokens and private keys.
How 0Day would have caught this
casdoor is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Casdoor version 4.4.0 or earlier, you are potentially affected.
What should I do right now?
Check your Casdoor version and upgrade to a version that properly masks the instance-wide built-in certificate private key.
Has this been exploited in the wild?
The vulnerability has not been confirmed as exploited in the wild. It is under investigation.
Where can I find more information?
Consult the primary sources for more information: CVE-2026-90942 and CVE-2026-91998.