CVE-2024-51987 - CVE House
Back to Database
Status published Medium CVE-2024-51987

HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect

Vulnerability Description

Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAccessTokenHttpClient` may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captured in pooled `HttpClient` instances, which may be used by a different user. Instead of using `AddUserAccessTokenHttpClient` to create an `HttpClient` that automatically adds a managed token to outgoing requests, you can use the `HttpConext.GetUserAccessTokenAsync` extension method or the `IUserTokenManagementService.GetAccessTokenAsync` method. This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51987

Credits & Attribution

No credits recorded in the NVD database.

References

More from DuendeSoftware

View All →
CVE-2025-26620
Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens
Medium 6.3
CVE-2024-49755
Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs
Low 3.1
CVE-2024-39694
Duende IdentityServer Open Redirect vulnerability
Medium 4.7

Affected Vendor

DuendeSoftware

View all reports →

Affected Software

Duende.AccessTokenManagement
Vulnerable Versions:
= 3.0.0

Timeline

Official Publish: November 7th, 2024
Last Modified: November 8th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-270

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.