Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

duende.identityserver

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.1NuGetPublished

    Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

    CVE-2024-49755 · GHSA-v9xq-2mvm-x8xc

    Affected
    • NuGet duende.identityserver >= 7.0.0, < 7.0.8
    Fixed in
    7.0.8· Vendor fix available
    Issue
    Impact IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens. Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. It does not impact: - OAuth or OIDC protocol endpoints defined by IdentityServer, such as the authorize and token endpoints. - Typical UI pages within an IdentityServer implementation, which are not normally authorized with the local API authentication handler. - The use of DPoP to create sender-constrained tokens in IdentityServer that are consumed by external API resources. - The use of DPoP to sender-constrain refresh tokens issued to public clients. Are you affected? This vulnerability only affects IdentityServer implementations that are using the…

    Recommended action: Upgrade to 7.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →