Casdoor IAM Exposure: Inventory Auth Servers Without Assuming Compromise

Casdoor is an identity and access management platform with a web UI and APIs for OAuth, OpenID Connect, SAML, and related identity workflows. Because the product can be self-hosted, an external asset inventory may find instances outside the organization's normal catalog. The count is useful for ownership review, not as proof of a security failure.

The selected count-only ZoomEye query was app="Casdoor" with scope all, page 1, and one result. On 2026-11-03, the observation returned 5,295 matching assets. The application fingerprint suggests a product relationship. It does not establish the deployment's version, tenant configuration, or whether administrative access is restricted.

Start with external identity boundaries

For each candidate, identify the organization, domain, certificate, and hosting provider. Confirm whether the service is a public identity provider, an internal tenant, a demonstration instance, or unrelated infrastructure. Review the public base URL, callback and redirect settings, API documentation exposure, and the separation between user and administrative roles.

Identity servers often support multiple applications. A single public host can represent many trust relationships. Inventory the tenants and application registrations from an authorized management interface, not from the external page. Check that secrets and signing keys are stored in a protected system and rotated according to policy.

Review configuration with product evidence

Casdoor's documentation covers application registration and OIDC flows. Use those concepts to structure the review. Verify redirect URI matching, token and session lifetimes, consent behavior, account recovery, and multi-factor options. Review logs for unusual sign-in attempts, configuration changes, and API activity. Do not infer compromise from a public login page or from the presence of a product fingerprint.

If an unknown host is found, treat it as an ownership and data-governance issue before attempting any security testing. It may contain user identities or application secrets. Contact the responsible team through an approved channel and preserve evidence if the instance is not authorized.

Keep the measurement honest

Store the normalized dork, scope, page settings, timestamp, count, and status. Do not convert a product count into a user count. Do not sum app and title observations, because they can overlap and use different matching relationships. Re-run the same query when a trend is needed, and disclose any error or quota limitation.

ZoomEye supports the discovery side of an IAM inventory. The response side is a configuration review: map the host, identify the tenant owner, verify the trust relationships, check the patch level, and record the decision. That sequence keeps an observed identity surface from being misreported as a confirmed compromise.

References

• Casdoor, Casdoor documentation
• Casdoor, Application overview
• Casdoor, Public API
• ZoomEye, ZoomEye