GHSA-7mr7-4f54-vcx5

Source

https://github.com/advisories/GHSA-7mr7-4f54-vcx5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-7mr7-4f54-vcx5/GHSA-7mr7-4f54-vcx5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-7mr7-4f54-vcx5

Aliases

CVE-2024-51987

Published

2024-11-07T21:57:52Z

Modified

2024-11-08T13:55:27Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

HTTP Client uses incorrect token after refresh

Details

Impact

HTTP Clients created by AddUserAccessTokenHttpClient may use a different user's access token after a token refresh. This occurs because a refreshed token will be captured in pooled HttpClient instances, which may be used by a different user.

Workarounds

Instead of using AddUserAccessTokenHttpClient to create an HttpClient that automatically adds a managed token to outgoing requests, you can use the HttpConext.GetUserAccessTokenAsync extension method or the IUserTokenManagementService.GetAccessTokenAsync method.

Patches

This issue is fixed in Duende.AccessTokenManagement.OpenIdConnect 3.0.1.

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-270"
    ],
    "github_reviewed_at": "2024-11-07T21:57:52Z",
    "nvd_published_at": "2024-11-08T00:15:15Z",
    "severity": "MODERATE"
}

References

Affected packages

NuGet / Duende.AccessTokenManagement.OpenIdConnect

Package

Name: Duende.AccessTokenManagement.OpenIdConnect; View open source insights on deps.dev
Purl: pkg:nuget/Duende.AccessTokenManagement.OpenIdConnect