Identity CVE · OAuth / OIDC / JWT
CVE-2025-26620Duende OAuth token management mixes tokens across requests
high
Product: Duende .NET OAuth token managementVendor: Duende SoftwareCWE-362Disclosed: 2025-02-18Status: PatchedProtocol deep diveNVD ↗
What broke
Duende's OAuth token-management package for .NET had a race: two concurrent requests could swap access tokens. The token is valid. It is just not yours. Patched by Duende.
Why it matters
This is the same class as Okta's Java SDK race (CVE-2025-67505). Identity SDKs that cache tokens in static or scoped objects will eventually leak a session across users under load. The bug report looks like "flaky auth." The incident looks like a customer seeing another customer's data.
What to do
- Upgrade the Duende token-management package.
- Do not store tokens in a singleton without a per-user key. Load tests should assert that user A never receives user B's
sub. - Prefer sender-constrained tokens (DPoP, mTLS) so a mixed token is useless on the wrong client.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.