Start with Identity
Identity CVE · OAuth / OIDC / JWT

CVE-2025-26620Duende OAuth token management mixes tokens across requests

high
Product: Duende .NET OAuth token managementVendor: Duende SoftwareCWE-362Disclosed: 2025-02-18Status: PatchedProtocol deep diveNVD ↗

What broke

Duende's OAuth token-management package for .NET had a race: two concurrent requests could swap access tokens. The token is valid. It is just not yours. Patched by Duende.

Why it matters

This is the same class as Okta's Java SDK race (CVE-2025-67505). Identity SDKs that cache tokens in static or scoped objects will eventually leak a session across users under load. The bug report looks like "flaky auth." The incident looks like a customer seeing another customer's data.

What to do

  • Upgrade the Duende token-management package.
  • Do not store tokens in a singleton without a per-user key. Load tests should assert that user A never receives user B's sub.
  • Prefer sender-constrained tokens (DPoP, mTLS) so a mixed token is useless on the wrong client.

After you patch

Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.

  • Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
  • Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
  • Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
  • Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of alg: none. See JWT and the validate a JWT recipe.

Sources

Last reviewed By SWI Community TeamSuggest a correctionHow we research

Technique

This CVE is an instance of Cross-tenant token confusion. A broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.

Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.