Duende.IdentityServer
The most flexible and standards-compliant OpenID Connect and OAuth 2.x framework for ASP.NET Core
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 48
- Cadence
- ~13 days
- Last 12 months
- 26
Reach
- Stars
- 1.6k
Details
- First release
- Mar 21, 2024
| Version | Released | |
|---|---|---|
8.1.0-preview.3
pre
|
8.1.0-preview.3
pre
Dependencies (8)
Changelog
Compare changes
|
|
8.0.7
patch
|
8.0.7
patch
Dependencies (6)
Changelog
Compare changes
|
|
8.0.6
patch
|
8.0.6
patch
Dependencies (6)
Changelog
Compare changes
|
|
7.4.11
patch
| ||
8.0.5
patch
|
8.0.5
patch
Dependencies (6)
Changelog
Compare changes
|
|
7.4.10
patch
| ||
7.4.9
patch
| ||
8.0.4
patch
|
8.0.4
patch
Dependencies (6)
Changelog
Compare changes
|
|
8.1.0-preview.2
pre
|
8.1.0-preview.2
pre
Dependencies (7)
Changelog
Compare changes
|
|
8.1.0-preview.1
pre
|
8.1.0-preview.1
pre
Dependencies (7)
Changelog
Compare changes
|
|
7.4.8
patch
| ||
8.0.3
patch
|
8.0.3
patch
Dependencies (6)
Changelog
Compare changes
|
|
8.0.2
patch
|
8.0.2
patch
Dependencies (6)
Changelog
Compare changes
|
|
8.0.1
patch
|
8.0.1
patch
Dependencies (6)
Changelog
Compare changes
|
|
8.0.0
major
|
8.0.0
major
Dependencies (6)
Changelog
Compare changes
|
|
8.0.0-preview.6
pre
|
8.0.0-preview.6
pre
Dependencies (6)
Changelog
Compare changes
|
|
8.0.0-preview.5
pre
|
8.0.0-preview.5
pre
Dependencies (6)
Changelog
Compare changes
|
|
8.0.0-preview.2
pre
|
8.0.0-preview.2
pre
Dependencies (5)
Changelog
Compare changes
|
|
7.4.7
patch
| ||
8.0.0-alpha.1
pre
| ||
7.4.6
patch
| ||
7.4.5
patch
| ||
7.3.4
patch
| ||
7.4.4
patch
| ||
7.3.3
patch
| ||
7.4.3
minor
| ||
7.3.2
patch
| ||
7.3.1
patch
| ||
7.3.0
minor
| ||
7.3.0-rc.2
pre
| ||
7.3.0-rc.1
pre
| ||
7.2.4
patch
| ||
7.2.3
patch
| ||
7.2.2
patch
| ||
7.2.1
patch
| ||
7.2.0
minor
| ||
7.1.1
patch
| ||
7.2.0-preview.1
pre
| ||
7.1.0
minor
| ||
7.1.0-rc.2
pre
| ||
7.1.0-rc.1
pre
| ||
7.1.0-preview.1
pre
| ||
7.0.8
patch
| ||
7.0.7
patch
1 CVE
CVE-2024-49755
GHSA-v9xq-2mvm-x8xc
Oct 28, 2024
Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs
Low
Adjacent
Low
None
ImpactIdentityServer's local API authentication handler performs insufficient validation of the Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the
Are you affected?This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either Vulnerable implementations of IdentityServer would have configuration code similar to the following: PatchesThis vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs. Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
Fixed in
7.0.8
References Updated Oct 28, 2024 · Source: OSV.dev | ||
7.0.6
patch
1 CVE
CVE-2024-49755
GHSA-v9xq-2mvm-x8xc
Oct 28, 2024
Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs
Low
Adjacent
Low
None
ImpactIdentityServer's local API authentication handler performs insufficient validation of the Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the
Are you affected?This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either Vulnerable implementations of IdentityServer would have configuration code similar to the following: PatchesThis vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs. Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
Fixed in
7.0.8
References Updated Oct 28, 2024 · Source: OSV.dev | ||
7.0.5
patch
2 CVEs
CVE-2024-49755
GHSA-v9xq-2mvm-x8xc
Oct 28, 2024
Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs
Low
Adjacent
Low
None
ImpactIdentityServer's local API authentication handler performs insufficient validation of the Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the
Are you affected?This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either Vulnerable implementations of IdentityServer would have configuration code similar to the following: PatchesThis vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs. Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
Fixed in
7.0.8
References Updated Oct 28, 2024 · Source: OSV.dev
CVE-2024-39694
GHSA-ff4q-64jc-gx98
Jul 31, 2024
IdentityServer Open Redirect vulnerability
Medium
Network
Low
None
ImpactIt is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. Affected Methods
PatchesThis vulnerability is fixed in the following versions of Duende.IdentityServer:
Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. WorkaroundsIf upgrading is not possible, use Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
6.3.0
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
+ 22 more Show less
6.3.6
6.3.7
6.3.8
6.3.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
Fixed in
6.0.5
6.1.8
6.2.5
6.3.10
7.0.6
References
Updated Jul 31, 2024 · Source: OSV.dev | ||
7.0.4
patch
2 CVEs
CVE-2024-49755
GHSA-v9xq-2mvm-x8xc
Oct 28, 2024
Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs
Low
Adjacent
Low
None
ImpactIdentityServer's local API authentication handler performs insufficient validation of the Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the
Are you affected?This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either Vulnerable implementations of IdentityServer would have configuration code similar to the following: PatchesThis vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs. Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
Fixed in
7.0.8
References Updated Oct 28, 2024 · Source: OSV.dev
CVE-2024-39694
GHSA-ff4q-64jc-gx98
Jul 31, 2024
IdentityServer Open Redirect vulnerability
Medium
Network
Low
None
ImpactIt is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. Affected Methods
PatchesThis vulnerability is fixed in the following versions of Duende.IdentityServer:
Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. WorkaroundsIf upgrading is not possible, use Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
6.3.0
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
+ 22 more Show less
6.3.6
6.3.7
6.3.8
6.3.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
Fixed in
6.0.5
6.1.8
6.2.5
6.3.10
7.0.6
References
Updated Jul 31, 2024 · Source: OSV.dev | ||
7.0.3
initial
2 CVEs
CVE-2024-49755
GHSA-v9xq-2mvm-x8xc
Oct 28, 2024
Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs
Low
Adjacent
Low
None
ImpactIdentityServer's local API authentication handler performs insufficient validation of the Note that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the
Are you affected?This vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either Vulnerable implementations of IdentityServer would have configuration code similar to the following: PatchesThis vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs. Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
Fixed in
7.0.8
References Updated Oct 28, 2024 · Source: OSV.dev
CVE-2024-39694
GHSA-ff4q-64jc-gx98
Jul 31, 2024
IdentityServer Open Redirect vulnerability
Medium
Network
Low
None
ImpactIt is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does not allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. Affected Methods
PatchesThis vulnerability is fixed in the following versions of Duende.IdentityServer:
Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. WorkaroundsIf upgrading is not possible, use Affected versions
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
6.3.0
6.3.1
6.3.2
6.3.3
6.3.4
6.3.5
+ 22 more Show less
6.3.6
6.3.7
6.3.8
6.3.9
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.1.0
6.1.1
6.1.2
6.1.3
6.1.4
6.1.5
6.1.6
6.1.7
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
Fixed in
6.0.5
6.1.8
6.2.5
6.3.10
7.0.6
References
Updated Jul 31, 2024 · Source: OSV.dev |