Identityserver
Monthly
A improper authentication vulnerability exists in Duende IdentityServer 4 affecting the Token Renewal Endpoint at /connect/authorize, where manipulation of the id_token_hint parameter can bypass authentication controls. This vulnerability affects Duende IdentityServer 4 across all versions, allowing remote attackers without credentials to gain unauthorized access with high complexity exploitation requirements. No active exploitation in the wild (KEV status unknown), no public proof-of-concept available, and the vendor has not responded to early disclosure attempts.
A improper authentication vulnerability exists in Duende IdentityServer 4 affecting the Token Renewal Endpoint at /connect/authorize, where manipulation of the id_token_hint parameter can bypass authentication controls. This vulnerability affects Duende IdentityServer 4 across all versions, allowing remote attackers without credentials to gain unauthorized access with high complexity exploitation requirements. No active exploitation in the wild (KEV status unknown), no public proof-of-concept available, and the vendor has not responded to early disclosure attempts.