Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.identity.web

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.7NuGetPublished

    Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

    CVE-2025-32016 · GHSA-rpq8-q44m-2rpg

    Affected
    • NuGet microsoft.identity.web >= 3.2.0, < 3.8.2
    Fixed in
    3.8.2· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Description: This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the service logs of these applications. Service logs are intended to be handled securely. Impact: The vulnerability impacts service logs that meet the following criteria: - Logging Level: Logs are generated at the information level. - Credential Descriptions: containing: - Local file paths with passwords. - Base64 encoded values. - Client secret. Additionally, logs of services using Base64 encoded certificates or certificate paths with password credential descriptions are also affected if the certificates are invalid or expired, regardless of the log level. Note that these credentials are not usable due to their invalid or expired status. If your service logs are handled securely, you are not…

    Recommended action: Upgrade to 3.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →