Skip to content
OpenAdvisories

Product · DuendeSoftware

IdentityServer

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2024-49755

    Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

    Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access t…

    DuendeSoftware IdentityServer Duende.IdentityServer NuGet