CVE Explorer

CVE-2026-4349

A vulnerability was determined in Duende IdentityServer4 up to 4.1.2. The affected element is an unknown function of the file /connect/authorize of the component Token Renewal Endpoint. This manipulation of the argument id_token_hint causes improper authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is described as difficult. This vulnerability only affects products that are no longer supported by the maintainer.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:5601ad36a9d293d819a60b006ef5133fa0d182936dc66f737a41b8b69d97df07

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cvss · 4 assertions

{"metric":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X","version":"3.0"},"metric_type":"cvssV3_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":5.1,"vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:ND","version":"2.0"},"metric_type":"cvssV2_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/3/cvssV2_0

{"metric":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","version":"4.0"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/0/cvssV4_0

{"metric":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/1/cvssV3_1

Affected products and versions

1 source assertion

{"modules":["Token Renewal Endpoint"],"product":"IdentityServer4","vendor":"Duende","versions":[{"status":"affected","version":"4.1.0"},{"status":"affected","version":"4.1.1"},{"status":"affected","version":"4.1.2"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/affected/0

Provider-owned CVSS observations

4 source assertions

{"metric":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X","version":"3.0"},"metric_type":"cvssV3_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":5.1,"vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:ND","version":"2.0"},"metric_type":"cvssV2_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/3/cvssV2_0

{"metric":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","version":"4.0"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/0/cvssV4_0

{"metric":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/metrics/1/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-287","description":"Improper Authentication","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions

{"name":"VDB-351380 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/?ctiid.351380"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/references/1

{"name":"VDB-351380 | Duende IdentityServer4 Token Renewal Endpoint authorize improper authentication","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/?id.351380"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/references/0

{"name":"Submit #772071 | DuendeSoftware Identity Server 4 Authentication Bypass Issues","tags":["third-party-advisory"],"url":"https://vuldb.com/?submit.772071"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:47a468fe1ef7acfc43727bb06a75d48d379fd4b6851484e9ab9e46f98bec6a69 · sha256:6fe60cca6648363e… · /containers/cna/references/2

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer