Read the docs
TI-2024-33222 Aliases CVE-2024-49755GHSA-v9xq-2mvm-x8xc

Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

Priority LOW 15CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens. Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Fixed IdentityServer (DuendeSoftware): 7.0.8Duende.IdentityServer (NuGet): 7.0.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DuendeSoftwareIdentityServer7.0.0 to before 7.0.87.0.8Patch availableCNA
—Duende.IdentityServer (NuGet)7.0.0 to before 7.0.87.0.8Patch availableGHSA-v9xq-2mvm-x8xc
  • IdentityServer VendorDuendeSoftware Affected 7.0.0 to before 7.0.8 Fixed in 7.0.8 Patch available CNA
  • Duende.IdentityServer (NuGet) Vendor— Affected 7.0.0 to before 7.0.8 Fixed in 7.0.8 Patch available GHSA-v9xq-2mvm-x8xc

Remediation

  • Fix · CNA IdentityServer (DuendeSoftware) Fixed in 7.0.8
  • Fix · GHSA-v9xq-2mvm-x8xc Duende.IdentityServer (NuGet) Fixed in 7.0.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-49755
  2. 2026-10-03 Alias added: GHSA-v9xq-2mvm-x8xc

References

Advisory 1

Other 3

  • TI-2025-19557 Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens CVSS 4.0MEDIUM 6.3
  • TI-2024-34875 HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect CVSS 3.1MEDIUM 5.4
  • TI-2024-26617 Duende IdentityServer Open Redirect vulnerability CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences