Skip to content
OpenAdvisories

Vendor

DuendeSoftware

4 known vulnerabilities.

Products

IdentityServer 2 Duende.AccessTokenManagement 1 foss 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.1
    CVE-2024-49755

    Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

    Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access t…

    DuendeSoftware IdentityServer Duende.IdentityServer NuGet