CVE-2024-21643

IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.

• CWE-94

• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0Release Notes
• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2Release Notes
• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5hVendor Advisory
• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/jkucveMitigation, Third Party Advisory
• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0Release Notes
• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2Release Notes
• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5hVendor Advisory
• https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/jkucveMitigation, Third Party Advisory

Published

Jan 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21637Authentik is an open-source Identity Provider. Authentik is …5.4
• CVE-2024-21638Azure IPAM (IP Address Management) is a lightweight solution…9.8
• CVE-2024-21639CEF (Chromium Embedded Framework ) is a simple framework for…9.6
• CVE-2024-21640Chromium Embedded Framework (CEF) is a simple framework for …9.6
• CVE-2024-21641Flarum is open source discussion platform software. Prior to…4.7
• CVE-2024-21642D-Tale is a visualizer for Pandas data structures. Users hos…7.5
• CVE-2024-21644pyLoad is the free and open-source Download Manager written …7.5
• CVE-2024-21645pyLoad is the free and open-source Download Manager written …5.3
• CVE-2024-21646Azure uAMQP is a general purpose C library for AMQP 1.0. The…9.8
• CVE-2024-21647Puma is a web server for Ruby/Rack applications built for pa…7.5
• CVE-2024-21648XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2024-21649The vantage6 technology enables to manage and deploy privacy…8.8