Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

steeltoe.security.authentication.jwtbearer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9NuGetPublished

    Steeltoe's static JWKS cache shared across schemes and never invalidated

    CVE-2026-50202 · GHSA-7fqc-p256-7pwj

    Affected
    • NuGet steeltoe.security.authentication.jwtbearer <= 4.1.0
    Fixed in
    4.2.0· Vendor fix available
    Issue
    The JWT signing key cache in TokenKeyResolver uses kid as the sole cache key without namespacing by authority. In applications with multiple JwtBearer schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another. Additionally, cached keys have no expiration, so rotated or revoked keys remain trusted until the application process restarts. Impact In multi-scheme deployments, an attacker who controls one identity provider's signing key can forge tokens accepted by other schemes within the same application. For all applications using TokenKeyResolver, a signing key removed from the identity provider's JWKS endpoint remains trusted indefinitely. Mitigations If an immediate upgrade is not possible: - In multi-scheme deployments, configure only one JwtBearer scheme per application when different identity providers are required. - Restart the application process after an identity provider signing key rotation to clear stale…

    Recommended action: Upgrade to 4.2.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →