Duende IdentityServer4 टोकन नवीनीकरण एंडपॉइंट (Token Renewal Endpoint) अनुचित प्रमाणीकरण (authentication) करता है

The core impact of CVE-2026-4349 lies in the potential for unauthorized authentication. An attacker who can control or influence the idtokenhint parameter can potentially bypass authentication checks and gain access to protected resources. This could lead to account takeover, data breaches, or other malicious activities. The high complexity requirement suggests that exploitation is not trivial and likely requires a deep understanding of the IdentityServer4 architecture and the authentication flow. The fact that this product is no longer supported significantly increases the risk, as security updates and patches are unlikely to be released.

Organizations relying on Duende IdentityServer4 versions 4.1.0–4.1.2, particularly those with critical data or sensitive applications protected by this identity provider, are at significant risk. Legacy systems or applications that have not been updated to newer identity management solutions are especially vulnerable.

• .NET / IdentityServer4: Monitor logs for unusual authentication requests targeting the /connect/authorize endpoint, specifically those containing suspicious values in the idtokenhint parameter. • .NET / IdentityServer4: Use a WAF to block requests with malformed or excessively long idtokenhint values. • .NET / IdentityServer4: Review application code for any custom handling of the idtokenhint parameter that might be vulnerable to manipulation.

1. 2026-03-17Disclosure

   disclosure

1. आरक्षित2026-03-17
2. प्रकाशित2026-03-17
3. संशोधित2026-03-25
4. EPSS अद्यतन2026-03-25

Due to the product's end-of-life status, direct patching is unavailable. The primary mitigation strategy is to migrate away from Duende IdentityServer4 to a supported alternative. If migration is not immediately feasible, consider implementing stricter input validation on the idtokenhint parameter to prevent malicious manipulation. Web Application Firewalls (WAFs) can be configured to filter suspicious requests targeting the /connect/authorize endpoint. Thoroughly review and restrict access to the IdentityServer4 instance to minimize the potential blast radius.