medium6.5Public exploit code
CVE-2023-34927
Casdoor Cross-Site Request Forgery vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF)2025-10-29 · webapps · multiple
- Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF)2025-09-16 · webapps · multiple
- Casdoor < v1.331.0 - '/api/set-password' CSRF2024-04-02 · webapps · go
Impact
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint `/api/set-password`. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/casdoor/casdoor | <= 1.331.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Casbin | Casdoor | through 1.331.0 |