CVE-2024-51987

Duende.AccessTokenManagement.OpenIdConnect is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. HTTP Clients created by `AddUserAccessTokenHttpClient` may use a different user's access token after a token refresh occurs. This occurs because a refreshed token will be captured in pooled `HttpClient` instances, which may be used by a different user. Instead of using `AddUserAccessTokenHttpClient` to create an `HttpClient` that automatically adds a managed token to outgoing requests, you can use the `HttpConext.GetUserAccessTokenAsync` extension method or the `IUserTokenManagementService.GetAccessTokenAsync` method. This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-270

• https://github.com/DuendeSoftware/Duende.AccessTokenManagement/security/advisories/GHSA-7mr7-4f54-vcx5

Published

Nov 8, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5198OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivi…3.3
• CVE-2024-51980An unauthenticated attacker may perform a limited server sid…5.3
• CVE-2024-51981An unauthenticated attacker may perform a blind server side …5.3
• CVE-2024-51982An unauthenticated attacker who can connect to TCP port 9100…7.5
• CVE-2024-51983An unauthenticated attacker who can connect to the Web Servi…7.5
• CVE-2024-51984An authenticated attacker can reconfigure the target device …6.8
• CVE-2024-51988RabbitMQ is a feature rich, multi-protocol messaging and str…6.5
• CVE-2024-51989Password Pusher is an open source application to communicate…7.1
• CVE-2024-5199The Spotify Play Button WordPress plugin through 1.0 does no…5.4
• CVE-2024-51990jj, or Jujutsu, is a Git-compatible VCS written in rust. In …9.3
• CVE-2024-51991October is a Content Management System (CMS) and web platfor…4.9
• CVE-2024-51992Orchid is a @laravel package that allows for rapid applicati…4.1