Casdoor vulnerable to Stored XSS via Application formCss / formSideHtml

Successful exploitation of CVE-2026-5468 allows an attacker to inject arbitrary JavaScript code into a user's browser session within the Casdoor application. This can lead to a variety of malicious actions, including session hijacking, credential theft, and defacement of the application's user interface. The attacker could potentially gain access to sensitive user data or compromise the entire Casdoor instance, depending on the privileges of the affected user. The availability of a public exploit significantly increases the likelihood of widespread exploitation.

Organizations utilizing Casdoor for authentication and authorization, particularly those relying on custom themes or configurations that leverage the dangerouslySetInnerHTML function, are at risk. Shared hosting environments where multiple applications share the same Casdoor instance are also vulnerable, as a compromise of one application could potentially impact others.

• go / server:

find /var/log/casdoor -type f -name '*.log' | grep -i 'dangerouslySetInnerHTML'

• generic web:

curl -I <casdoor_url>/ | grep -i 'content-security-policy'

1. 2026-04-03Disclosure

   disclosure

1. 予約済み2026-04-03
2. 公開日2026-04-03
3. 更新日2026-04-10
4. EPSS 更新日2026-04-11

The primary mitigation for CVE-2026-5468 is to upgrade to a patched version of Casdoor. Unfortunately, a specific fixed version is not yet available. Until a patch is released, consider implementing input validation and sanitization on the formCss, formCssMobile, and formSideHtml parameters to prevent malicious code injection. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor Casdoor logs for suspicious activity, particularly related to user input and rendering of HTML content.