Casdoor MCP Endpoint Authorization Bypass

Technical Analysis

The vulnerability resides in Casdoor's /api/mcp endpoint, which fails to properly scope authorization checks to the requesting application's organization, effectively allowing any valid clientId/clientSecret pair to escalate to global administrative access over the identity provider. Exploitation requires no special privileges beyond possessing legitimate credentials for any registered application, making it low-complexity and highly attractive to attackers who compromise a single low-value app integration. Successful exploitation exposes password salts and email addresses across all organizations and permits creation of rogue administrator accounts, enabling full identity provider takeover. Casdoor is frequently used as an SSO/IAM backend for internal tools and platforms, including those exposing MCP (Model Context Protocol) interfaces used by AI agent frameworks to authenticate and authorize tool access. Given that MCP is a core protocol for connecting LLM agents to external tools and data sources, this flaw directly threatens agent deployments relying on Casdoor for identity management, potentially allowing attackers to hijack agent credentials, impersonate administrative agent identities, or pivot into connected RAG pipelines and tool integrations.

Affected Systems

Casdoor identity and access management platform, all versions through 4.4.0, specifically deployments exposing the /api/mcp endpoint with multi-tenant/multi-organization configurations

Indicators of Compromise

• Anomalous API calls to /api/mcp endpoint with mismatched organization context
• Unexpected creation of new administrator accounts across organizations
• Bulk enumeration requests against user listing endpoints
• Use of unfamiliar or newly registered application clientId/clientSecret pairs against /api/mcp

Remediation Steps

1. 1

   Upgrade Casdoor

   Apply the vendor patch or upgrade to a Casdoor version beyond 4.4.0 once released that enforces proper organization-scoped authorization on the /api/mcp endpoint.

2. 2

   Restrict MCP endpoint access

   Temporarily disable or restrict network access to /api/mcp until patched, limiting exposure to trusted internal networks only.

3. 3

   Rotate credentials

   Rotate all clientId/clientSecret pairs and force password resets for potentially exposed accounts, especially administrator accounts created or modified during the exposure window.

4. 4

   Audit administrative accounts

   Review all organizations for unauthorized or unexpected administrator account creation, and audit logs for cross-organization access from unfamiliar applications.

5. 5

   Implement least-privilege application scoping

   Ensure each registered application's clientId/clientSecret is scoped to only the minimum necessary organization and permissions, reducing blast radius of any single credential compromise.

6. 6

   Monitor agent-connected identity flows

   If Casdoor authenticates AI agent or MCP-based tool integrations, audit agent credential usage and API key exposure, and rotate any keys agents use to authenticate through Casdoor.