CVE-2024-51987

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAccessTokenHttpClient` may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captured in pooled `HttpClient` instances, which may be used by a different user. Instead of using `AddUserAccessTokenHttpClient` to create an `HttpClient` that automatically adds a managed token to outgoing requests, you can use the `HttpConext.GetUserAccessTokenAsync` extension method or the `IUserTokenManagementService.GetAccessTokenAsync` method. This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-270

Affected software

No affected versions have been published.

Timeline

Published: Nov 8, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-519886.5RabbitMQ is a feature rich, multi-protocol messaging and streaming broker. In affected versions queue deletion via the HTTP API was not veri CVE-2024-519897.1Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting (XSS) vulnerability CVE-2024-51995.4The Spotify Play Button WordPress plugin through 1.0 does not validate and escape some of its shortcode attributes before outputting them ba CVE-2024-519909.3jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write fil CVE-2024-519914.9October is a Content Management System (CMS) and web platform. A vulnerability in versions prior to 3.7.5 affects authenticated administrato CVE-2024-519924.1Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. T CVE-2024-519933.4Combodo iTop is a web based IT Service Management tool. An attacker accessing a backup file or the database can read some passwords for misc CVE-2024-519945.4Combodo iTop is a web based IT Service Management tool. In affected versions uploading a text file containing some java script in the portal CVE-2024-519957.1Combodo iTop is a web based IT Service Management tool. An attacker can request any `route` we want as long as we specify an `operation` tha CVE-2024-519967.5Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me CVE-2024-519978.1Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART (**Attestation Results Tok CVE-2024-519988.6changedetection.io is a free open source web page change detection tool. The validation for the file URI scheme falls short, and results in