GitHub Advisoryadvisory · NuGet

GHSA-7mr7-4f54-vcx5 HTTP Client uses incorrect token after refresh

MEDIUM Published 2024-11-07 Modified 2024-11-08 Official page ↗
Aliases
CVE-2024-51987
Ecosystem
NuGet
Packages
Duende.AccessTokenManagement.OpenIdConnect
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-270
Reviewed
2024-11-07

Affected packages

• NuGet Duende.AccessTokenManagement.OpenIdConnect: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

Impact HTTP Clients created by `AddUserAccessTokenHttpClient` may use a different user's access token after a token refresh. This occurs because a refreshed token will be captured in pooled `HttpClient` instances, which may be used by a different user. Workarounds Instead of using `AddUserAccessTokenHttpClient` to create an `HttpClient` that automatically adds a managed token to outgoing requests, you can use the `HttpConext.GetUserAccessTokenAsync` extension method or the `IUserTokenManagementService.GetAccessTokenAsync` method. Patches This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1.

Related

Alias · CVE (1)

  • CVE-2024-51987 Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. vulnerability

Weakness · CWE (1)

  • CWE-270 Privilege Context Switching Error weakness

References