AIKIDO-2026-542944

Duende.BFF.Yarp is vulnerable to Exposure of Sensitive Information

Exposure of Sensitive InformationGHSA-vvg7-p7jw-8qr3 Published Today

Medium Risk

This Affects:

Duende.BFF.Yarp

0.0.1 - 2.2.0

Fixed in 2.2.1

2.3.0 - 2.3.0

Fixed in 2.3.1

3.0.0 - 3.0.0

Fixed in 3.0.1

3.1.0 - 3.1.0

Fixed in 3.1.1

4.0.0 - 4.0.3

Fixed in 4.0.4

4.1.0 - 4.1.2

Fixed in 4.1.3

4.2.0 - 4.2.0

Fixed in 4.2.1

4.3.0 - 4.3.0

Fixed in 4.3.1

Are you affected? Scan for Free

TL;DR

Duende.BFF proxies requests to remote APIs through its YARP integration (AddYarpConfig or AddBffExtensions with MapReverseProxy or MapBffReverseProxy) and forwards the browser's inbound Cookie header to the upstream API by default on routes with BFF access token metadata. Anyone who can read request headers at that API, its logs, or an intermediary proxy can replay the forwarded BFF session cookie directly against the BFF to act as the signed in user. The BFF's anti-forgery header check does not block this replay, since the attacker sends the request directly and can add the header. The fix removes the Cookie header from proxied YARP requests by default.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you use the YARP integration with a route that carries BFF access token metadata.

Background info

Duende.BFF.Yarp is vulnerable to Exposure of Sensitive Information in versions 0.0.1 - 2.2.0, 2.3.0 - 2.3.0, 3.0.0 - 3.0.0, 3.1.0 - 3.1.0, 4.0.0 - 4.0.3, 4.1.0 - 4.1.2, 4.2.0 - 4.2.0 and 4.3.0 - 4.3.0.