Duendesoftware vulnerabilities

Products

• Identityserver 2

Newest

• duendesoftware foss Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens CVE-2025-26620 Fix available 6.3 MediumFebruary 18, 2025
• duendesoftware duende.accesstokenmanagement HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect CVE-2024-51987 Fix available 5.4 MediumNovember 7, 2024
• duende identityserver Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs CVE-2024-49755 Fix available 3.1 LowOctober 28, 2024
• duende identityserver Duende IdentityServer Open Redirect vulnerability CVE-2024-39694 Fix available 4.7 MediumJuly 31, 2024