CVE-2024-51987CWE-270

HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect

Medium · published November 7, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAccessTokenHttpClient` may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captured in pooled `HttpClient` instances, which may be used by a different user. Instead of using `AddUserAccessTokenHttpClient` to create an `HttpClient` that automatically adds a managed token to outgoing requests, you can use the `HttpConext.GetUserAccessTokenAsync` extension method or the `IUserTokenManagementService.GetAccessTokenAsync` method. This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.3th percentile
Weakness
CWE-270 · Privilege Context Switching Error
Published
2024-11-07T23:36Z
EPSS history
Timeline
  • 07 NOV 23:36Z
    HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect
    cvelistv5