Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-4349

Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. This vulnerability only affects products that are no longer supported by the maintainer.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Duende IdentityServer4

  • 4.1.0affected
  • 4.1.1affected
  • 4.1.2affected

References