A critical vulnerability in Casdoor versions up to 4.4.0 allows authenticated organization administrators to extract sensitive private keys, facilitating total account takeover across the platform.

The application fails to perform adequate masking of the instance-wide built-in certificate private key within the /api/get-certs and /api/get-cert endpoints. This flaw allows any authenticated user with organization administrator privileges to retrieve the plaintext private key, which is then used to sign fraudulent JWT tokens for any user or global administrator.

The ability to forge JWT tokens represents a total compromise of the identity and access management system. An attacker can impersonate any user, including global administrators, leading to full unauthorized access to sensitive corporate resources and data. Given the CVSS score of 9.6, this vulnerability poses an extreme risk to organizational security and compliance posture.

Immediate Action: Update the Casdoor installation to the latest available version that includes the patch for this private key exposure. If an immediate update is not feasible, restrict access to the /api/get-certs and /api/get-cert endpoints at the network or application layer.

Proactive Monitoring: Review all application access logs for unusual requests to the /api/get-certs and /api/get-cert endpoints, particularly those originating from non-administrative or suspicious organizational accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect API requests and block access to the affected certificate endpoints for any user lacking the necessary system-wide administrative permissions.

Public Exploit Available: Unknown

This vulnerability is severe and requires immediate attention to prevent full system compromise. Organizations must prioritize applying the vendor provided patch to ensure that certificate management endpoints are properly protected and that private keys are shielded from unauthorized administrative access. Failure to remediate this issue leaves the entire authentication infrastructure vulnerable to persistent and undetectable impersonation attacks.