Log in Start free

DuendeSoftware

Products

ProductCVEsExploitedLatest
IdentityServer2–Oct 28, 2024
Duende.AccessTokenManagement1–Nov 7, 2024
foss1–Feb 18, 2025

Exploited and recent CVEs

  • CVE-2025-26620 Medium 6.3 Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens 0.4%
  • CVE-2024-51987 Medium 5.4 HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect 0.2%
  • CVE-2024-49755 Low 3.1 Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs 0.3%
  • CVE-2024-39694 Medium 4.7 Duende IdentityServer Open Redirect vulnerability 0.5%