CVE-2026-90942

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.4.1

Description Casdoor fails to properly mask the instance-wide built-in certificate private key. This allows organization administrators to retrieve the private key via the '/api/get-certs' and '/api/get-cert' endpoints. An attacker with this private key can forge JSON Web Tokens (JWT), which are compact, URL-safe means of representing claims to be transferred between two parties, for any user across any organization, including global administrators.

Recommendations Update to a version newer than 4.4.0. Restrict access to the '/api/get-certs' and '/api/get-cert' endpoints to minimize the risk of private key exposure.