Skip to content
OpenAdvisories

Package · NuGet

Duende.IdentityServer

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 3.1
    CVE-2024-49755

    Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

    Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access t…

    DuendeSoftware IdentityServer Duende.IdentityServer NuGet
  • Medium 4.7
    CVE-2024-39694

    Duende IdentityServer Open Redirect vulnerability

    Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a re…

    DuendeSoftware IdentityServer IdentityServer4 Duende.IdentityServer NuGet