Vulnerability · Published Nov 7, 2024 · Assigned by GitHub_M
CVE-2024-51987HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect
Medium 5.4
In plain English
A medium-severity security flaw in Duende.AccessTokenManagement from DuendeSoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAccessTokenHttpClient` may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captured in pooled `HttpClient` instances, which may be used by a different user. Instead of using `AddUserAccessTokenHttpClient` to create an `HttpClient` that automatically adds a managed token to outgoing requests, you can use the `HttpConext.GetUserAccessTokenAsync` extension method or the `IUserTokenManagementService.GetAccessTokenAsync` method. This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | duende.accesstokenmanagement.openidconnect | 3.0.1 | GHSA-7mr7-4f54-vcx5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DuendeSoftware | Duende.AccessTokenManagement | = 3.0.0 |
Weakness: CWE-270 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N