CVE-2025-26620Duende OAuth token management mixes tokens across requests
What broke
Duende's OAuth token-management package for .NET had a race: two concurrent requests could swap access tokens. The token is valid. It is just not yours. Patched by Duende.
Why it matters
This is the same class as Okta's Java SDK race (CVE-2025-67505). Identity SDKs that cache tokens in static or scoped objects will eventually leak a session across users under load. The bug report looks like "flaky auth." The incident looks like a customer seeing another customer's data.
What to do
- Upgrade the Duende token-management package.
- Do not store tokens in a singleton without a per-user key. Load tests should assert that user A never receives user B's
sub. - Prefer sender-constrained tokens (DPoP, mTLS) so a mixed token is useless on the wrong client.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
Related identity CVEs
Related on Start with Identity
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b
- GlossaryToken Exchange
An OAuth 2.0 extension (RFC 8693) that exchanges one token for another, enabling delegation and impersonation across services. Increasingly used to scope tokens
- CVEWordPress OAuth SSO plugin JWT bypass, admin takeover
The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.
- GlossaryAgentic Identity
Identity for autonomous AI agents that act on a user's behalf, call APIs, and chain tools. Requires scoped, delegated, auditable, and revocable credentials rath
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
Technique
This CVE is an instance of Cross-tenant token confusion. A broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.