CVE-2024-41657

highpriority · track · 35EPSS 0.008 · 56 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.79% (56th) EPSS

CVSS 8.8 · high

Is it mine?

4 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 5.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsecondary · OSV

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-697USprimaryCWE-942USCWE-942US

affected products (4)

Products and version ranges known to be affected.

casdoor casdoor≤ ≤ 1.577.0enisa_euvdEU
casbin casdoorall versionsnvdUScpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:*
Go github.com/casdoor/casdoorall versionsosvUSpkg:golang/github.com/casdoor/casdoor
Go github.com/casdoor/casdoor≤ 1.557.0osvUSpkg:golang/github.com/casdoor/casdoor

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-mchx-7j67-8mcfCasdoor CORS misconfiguration (GHSL-2024-035)2024-08-22ghsa · osvUS
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in checking only for a prefix when authenticating the Origin header, any domain can create a valid subdomain with a valid subdomain prefix (Ex: localhost.example.com), allowing the website to make requests to Casdoor as the current signed-in user.
GO-2024-3087Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor2024-08-30vendor · osvUS
Casdoor CORS misconfiguration (GHSL-2024-035) in github.com/casdoor/casdoor

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2024-08-20modified 2026-06-17

related (221)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-5217US	critical9.8OT critical	99.6% (100th)	KEV	2024-07-10
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable a…
CVE-2020-5849US	high7.5OT critical	93.2% (100th)	KEV	2020-03-16
Unraid 6.8.0 allows authentication bypass.
CVE-2020-8864US	high8.8	81.7% (100th)	—	2020-03-23
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authe…
CVE-2023-32571US	critical9.8	34.9% (98th)	Exploit	2023-06-22
Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed…
CVE-2019-10071US	critical9.8	8.75% (95th)	—	2019-09-16
The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could le…

+216 more

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan