Vulnerabilities

TI-2025-19557 CVE-2025-26620 · GHSA-qxj7-2x7w-3mpp

Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

LOW 34

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00392 Published 2025-02-18 Fixed in 3.2.0 CWE-367

TI-2024-34875 CVE-2024-51987 · GHSA-7mr7-4f54-vcx5

LOW 24

Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0024 Published 2024-11-07 Fixed in 3.0.1 CWE-270

TI-2024-33222 CVE-2024-49755 · GHSA-v9xq-2mvm-x8xc

LOW 15

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core.

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00348 Published 2024-10-28 Fixed in 7.0.8 CWE-287

TI-2024-26617 CVE-2024-39694 · GHSA-ff4q-64jc-gx98

LOW 22

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00534 Published 2024-07-31 Fixed in 6.0.5, 7.0.6 +3 CWE-601