Which versions of Identityserver are affected by CVE-2026-4349?

Organizations using A vulnerability should be aware of moderate risk from CVE-2026-4349, a improper authentication vulnerability rated CVSS 5.6.

How to fix or mitigate CVE-2026-4349?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Identityserver CVE-2026-4349

Q: What is the CVSS score of CVE-2026-4349?

CVE-2026-4349 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-12659 MEDIUM

Improper Authentication (CWE-287)

2026-03-17 VulDB

Authentication Bypass Identityserver

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 22, 2026 - 21:37 NVD

5.6 (MEDIUM) 6.3 (MEDIUM)

EUVD ID Assigned

Mar 17, 2026 - 22:00 euvd

EUVD-2026-12659

Analysis Generated

Mar 17, 2026 - 22:00 vuln.today

CVE Published

Mar 17, 2026 - 21:32 nvd

MEDIUM 5.6

DescriptionCVE.org

A vulnerability was determined in Duende IdentityServer 4. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

A improper authentication vulnerability exists in Duende IdentityServer 4 affecting the Token Renewal Endpoint at /connect/authorize, where manipulation of the id_token_hint parameter can bypass authentication controls. This vulnerability affects Duende IdentityServer 4 across all versions, allowing remote attackers without credentials to gain unauthorized access with high complexity exploitation requirements. No active exploitation in the wild (KEV status unknown), no public proof-of-concept available, and the vendor has not responded to early disclosure attempts.

Technical ContextAI

The vulnerability resides in Duende IdentityServer 4 (CPE: cpe:2.3:a:duende:identityserver:*:*:*:*:*:*:*:*), specifically in the /connect/authorize endpoint which handles OpenID Connect token renewal flows. The root cause is classified as CWE-287 (Improper Authentication), indicating that the id_token_hint parameter—intended as a hint to optimize token validation—is being insufficiently validated before accepting authentication decisions. The id_token_hint is an OpenID Connect standard parameter designed to improve user experience by providing a previously-issued ID token, but improper implementation allows attackers to supply crafted values that circumvent proper authentication mechanisms.

RemediationAI

Immediate action: Contact Duende Software directly for security patches, as the vendor has not yet responded to disclosure. Until a patch is available, implement compensating controls by: (1) enforcing strict validation of all id_token_hint values server-side, rejecting any hints that do not cryptographically verify against the issuer's key material; (2) disabling the id_token_hint optimization if not strictly required by business logic; (3) implementing additional authentication factors or re-authentication ceremonies for sensitive operations; (4) restricting network access to /connect/authorize via Web Application Firewall (WAF) rules that validate OpenID Connect request syntax; (5) enabling detailed audit logging of all token renewal attempts with parameter inspection. Monitor VulDB (https://vuldb.com/?id.351380) and official Duende channels for patch announcements.