Microsoft.Identity.Web

This package enables ASP.NET Core web apps and web APIs to use the Microsoft identity platform (formerly Azure AD v2.0). This package is specifically used for web applications, which sign-in users, and protected web APIs, which optionally call downstream web APIs.

Latest 4.14.2

NuGet

95%

Total Score

Maintainer Stability

100

Dependencies

Maturity

100

Supply Chain

100

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-871761 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. Microsoft.Identity.Web is vulnerable to Cross-Site Request Forgery (CSRF) in versions 4.6.0 - 4.8.0.	4.6.0 - 4.8.0	Medium
AIKIDO-2026-295878 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. Microsoft.Identity.Web is vulnerable to Open Redirect in versions 3.0.0 - 3.14.0 and 4.0.0 - 4.8.0.	3.0.0 - 3.14.04.0.0 - 4.8.0	Medium
CVE-2025-32016 Microsoft.Identity.Web is vulnerable to Insertion of Sensitive Information into Log File in versions 3.2.0 - 3.8.2.	3.2.0 - 3.8.2	Medium

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
microsoft.identity.web.certificateless Version [4.14.2, )	—	—
microsoft.identity.web.certificate Version [4.14.2, )	—	—
microsoft.identity.web.tokenacquisition Version [4.14.2, )	—	—
microsoft.identity.web.tokencache Version [4.14.2, )	—	—
microsoft.identitymodel.protocols.openidconnect Version [8.22.0, )	—	—