Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExchangeToken function in object/token_oauth.go validates JWT signatures but does not verify that the tokens user belongs to the same organization as the target application. This can result in privilege escalation across organizational boundaries.