Duende.IdentityServer

The most flexible and standards-compliant OpenID Connect and OAuth 2.x framework for ASP.NET Core

View on Nuget

View on Github

Activity

Latest release: 2w ago
Total releases: 59
Cadence: ~6 days
Last 12 months: 37

Reach

Stars: 1.6k

Details

First release: Mar 21, 2024

Releases

Version	Released
`8.0.10` patch	Oct 15, 2026
`7.4.14` patch	Oct 15, 2026
`8.1.0-preview.4` pre	Oct 02, 2026
`7.1.3` patch	Sep 28, 2026
`7.3.5` patch	Sep 28, 2026
`7.0.10` patch	Sep 28, 2026
`7.2.5` patch	Sep 28, 2026
`7.4.13` patch	Sep 28, 2026
`8.0.9` patch	Sep 28, 2026
`8.0.8` patch	Sep 15, 2026
`7.4.12` patch	Sep 15, 2026
`8.1.0-preview.3` pre	Sep 08, 2026
`8.0.7` patch	Sep 03, 2026
`8.0.6` patch	Aug 13, 2026
`7.4.11` patch	Aug 13, 2026
`8.0.5` patch	Aug 10, 2026
`7.4.10` patch	Aug 10, 2026
`7.4.9` patch	Jul 29, 2026
`8.0.4` patch	Jul 28, 2026
`8.1.0-preview.2` pre	Jul 23, 2026
`8.1.0-preview.1` pre	Jul 23, 2026
`7.4.8` patch	Jul 20, 2026
`8.0.3` patch	Jul 20, 2026
`8.0.2` patch	Jun 16, 2026
`8.0.1` patch	Jun 11, 2026
`8.0.0` major	Jun 01, 2026
`8.0.0-preview.6` pre	Jun 01, 2026
`8.0.0-preview.5` pre	May 31, 2026
`8.0.0-preview.2` pre	May 28, 2026
`7.4.7` patch	Mar 13, 2026
`8.0.0-alpha.1` pre	Mar 02, 2026
`7.4.6` patch	Feb 12, 2026
`7.4.5` patch	Jan 22, 2026
`7.3.4` patch	Dec 29, 2025
`7.4.4` patch	Dec 29, 2025
`7.3.3` patch	Dec 09, 2025
`7.4.3` minor	Dec 09, 2025
`7.3.2` patch	Sep 17, 2025
`7.3.1` patch	Aug 15, 2025
`7.3.0` minor	Aug 14, 2025
`7.3.0-rc.2` pre	Jul 24, 2025
`7.3.0-rc.1` pre	Jul 02, 2025
`7.2.4` patch	Jun 04, 2025
`7.2.3` patch	May 07, 2025
`7.2.2` patch	Apr 30, 2025
`7.2.1` patch	Apr 16, 2025
`7.2.0` minor	Mar 18, 2025
`7.1.1` patch	Mar 04, 2025
`7.2.0-preview.1` pre	Jan 29, 2025
`7.1.0` minor	Jan 15, 2025

1–50 of 59

Repository

duendesoftware/products

Forks: 387
Open issues: 0
Language: C#

oauth
openid-connect
oidc
security
identity
aspnetcore

Dependencies (6)

Depends on

8.0.10

Used by

Supply-chain exposure

65 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2024-49755 GHSA-v9xq-2mvm-x8xc Oct 28, 2024

Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs

Low
Adjacent Low None

Impact

IdentityServer's local API authentication handler performs insufficient validation of the cnf claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens.

Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the LocalApiAuthenticationHandler for authentication. It does not impact:

OAuth or OIDC protocol endpoints defined by IdentityServer, such as the authorize and token endpoints.

Typical UI pages within an IdentityServer implementation, which are not normally authorized with the local API authentication handler.

The use of DPoP to create sender-constrained tokens in IdentityServer that are consumed by external API resources.

The use of DPoP to sender-constrain refresh tokens issued to public clients.

Are you affected?

This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either AddLocalApi or AddLocalApiAuthentication, and the opt-in to DPoP for local APIs is enabled via the TokenMode option.

Vulnerable implementations of IdentityServer would have configuration code similar to the following:

services.AddAuthentication() .AddLocalApi("local", options => { options.TokenMode = LocalApiTokenMode.DPoPAndBearer; // or LocalApiTokenMode.DPoPOnly });

Patches

This vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.

Affected versions

7.0.07.0.17.0.27.0.37.0.47.0.57.0.67.0.7

Fixed in

7.0.8

References

https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-v9xq-2mvm-x8xc
https://nvd.nist.gov/vuln/detail/CVE-2024-49755
https://github.com/DuendeSoftware/IdentityServer/commit/f28cac921c1f545afe65af71a9327224755b6dac
https://github.com/DuendeSoftware/IdentityServer

Updated Oct 28, 2024 · Source: OSV.dev
CVE-2024-39694 GHSA-ff4q-64jc-gx98 Jul 31, 2024

IdentityServer Open Redirect vulnerability

Medium
Network Low None

Impact

It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site.

Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials.

Affected Methods

In the DefaultIdentityServerInteractionService, the GetAuthorizationContextAsync method may return non-null and the IsValidReturnUrl method may return true for malicious Urls, indicating incorrectly that they can be safely redirected to.

UI code calling these two methods is the most commonly used code path that will expose the vulnerability. The default UI templates rely on this behavior in the Login, Challenge, Consent, and Account Creation pages. Customized user interface code might also rely on this behavior. The following uncommonly used APIs are also vulnerable:

The ServerUrlExtensions.GetIdentityServerRelativeUrl, ReturnUrlParser.ParseAsync and OidcReturnUrlParser.ParseAsync methods may incorrectly return non-null, and the ReturnUrlParser.IsValidReturnUrl and OidcReturnUrlParser.IsValidReturnUrl methods may incorrectly return true for malicious Urls.

Patches

This vulnerability is fixed in the following versions of Duende.IdentityServer:

7.0.6

6.3.10

6.2.5

6.1.8

6.0.5

Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates.

Workarounds

If upgrading is not possible, use IUrlHelper.IsLocalUrl from ASP.NET Core 5.0 or later to validate return Urls in user interface code in the IdentityServer host.

Affected versions

7.0.07.0.17.0.27.0.37.0.47.0.56.3.06.3.16.3.26.3.36.3.46.3.5

+ 22 more Show less

6.3.66.3.76.3.86.3.96.2.06.2.16.2.26.2.36.2.46.1.06.1.16.1.26.1.36.1.46.1.56.1.66.1.76.0.06.0.16.0.26.0.36.0.4

Fixed in

6.0.56.1.86.2.56.3.107.0.6

References

https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98
https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366
https://nvd.nist.gov/vuln/detail/CVE-2024-39694
https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6
https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e
https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1

Updated Jul 31, 2024 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 1
minor 4
patch 39
pre 14

59 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More