AIKIDO-2026-346781

Duende.IdentityServer is vulnerable to Improper Authorization

Improper AuthorizationGHSA-mxv6-xwqj-ww2p Published Yesterday

High Risk

This Affects:

Duende.IdentityServer

7.0.0 - 7.0.9

Fixed in 7.0.10

7.1.0 - 7.1.2

Fixed in 7.1.3

7.2.0 - 7.2.4

Fixed in 7.2.5

7.3.0 - 7.3.4

Fixed in 7.3.5

7.4.0 - 7.4.12

Fixed in 7.4.13

8.0.0 - 8.0.8

Fixed in 8.0.9

Are you affected? Scan for Free

TL;DR

The pushed authorization request (PAR) endpoint in Duende.IdentityServer accepts a pushed request without checking that its client_id matches the client that authenticated to the endpoint. A party with valid credentials for one registered client can push an authorization request for a different client and receive a request_uri for it, preloading state, PKCE parameters, and scopes the victim client did not create. When AllowUnregisteredPushedRedirectUris is enabled, implicit only clients and non-https redirect URIs could also skip registration, extending the exposure to redirect based token theft for confidential clients. The fix rejects pushed requests whose client_id does not match the authenticated client and only allows unregistered redirect URIs that use https, do not belong to implicit only clients, and do not match a disallowed prefix.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

Duende.IdentityServer is vulnerable to Improper Authorization in versions 7.0.0 - 7.0.9, 7.1.0 - 7.1.2, 7.2.0 - 7.2.4, 7.3.0 - 7.3.4, 7.4.0 - 7.4.12 and 8.0.0 - 8.0.8.