CVE-2024-49755: Duende IdentityServer Insufficient DPoP cnf Claim Validation Vulnerability
Summary
CVE-2024-49755: Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs. Affects Duende.IdentityServer versions >= 7.0.0, < 7.0.8. Fixed in 7.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Duende IdentityServer is a popular open-source framework for implementing authentication and authorization in .NET applications. It provides support for various protocols including OAuth2 and OpenID Connect, enabling developers to secure their applications with ease. The framework includes features for local API authentication, which allows for secure communication between services within the same application. However, a recent vulnerability has been identified that affects the validation of DPoP (Demonstration of Proof-of-Possession) claims in access tokens used for local APIs.
Vulnerability Detail
The vulnerability arises from insufficient validation of the 'cnf' claim in DPoP access tokens by the Local API authentication handler in IdentityServer. This flaw allows attackers to exploit leaked DPoP access tokens at local API endpoints without needing the private key for signing proof tokens. The issue specifically affects custom endpoints that utilize the LocalApiAuthenticationHandler for authentication, posing a risk to implementations that have enabled DPoP for local APIs. It does not impact standard OAuth or OIDC protocol endpoints or typical UI pages within IdentityServer.
How To Fix
Latest published version: 8.0.10 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.8
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling DPoP for local APIs until the update can be applied. This can be done by configuring the LocalApiAuthenticationHandler without DPoP support. For example, modify your configuration code as follows:
services.AddAuthentication()
.AddLocalApi("local", options =>
{
options.TokenMode = LocalApiTokenMode.BearerOnly;
});
Conclusion
CVE-2024-49755 highlights a significant vulnerability in Duende IdentityServer related to the insufficient validation of DPoP claims in local API authentication. It is crucial for developers using this framework to update to version 7.0.8 or later to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for Duende.IdentityServer →
FAQ
The vulnerability allows attackers to use leaked DPoP access tokens at local API endpoints, potentially compromising the security of the application.
Only IdentityServer implementations that use the local APIs feature and have enabled DPoP for local APIs are affected.
You can use Vulert's playground to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
As a temporary measure, disable DPoP for local APIs in your configuration until you can apply the patch.
The CVSS score for CVE-2024-49755 is 3.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for Duende.IdentityServer.
