CVE-2025-26620Duende OAuth token management mixes tokens across requests
What broke
Duende's OAuth token-management package for .NET had a race: two concurrent requests could swap access tokens. The token is valid. It is just not yours. Patched by Duende.
Why it matters
This is the same class as Okta's Java SDK race (CVE-2025-67505). Identity SDKs that cache tokens in static or scoped objects will eventually leak a session across users under load. The bug report looks like "flaky auth." The incident looks like a customer seeing another customer's data.
What to do
- Upgrade the Duende token-management package.
- Do not store tokens in a singleton without a per-user key. Load tests should assert that user A never receives user B's
sub. - Prefer sender-constrained tokens (DPoP, mTLS) so a mixed token is useless on the wrong client.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
Related identity CVEs
Related on Start with Identity
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEF5 BIG-IP APM heap overflow in the OAuth authorization server, exploited as a zero-day
BIG-IP APM configured as an OAuth authorization server had a heap overflow that unauthenticated traffic could turn into remote code execution. CVSS 9.8, exploit
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b
- GlossaryOAuth 2.0 Protected Resource Metadata
OAuth 2.0 Protected Resource Metadata ([RFC 9728](https://www.rfc-editor.org/rfc/rfc9728), Proposed Standard, April 2025) is a JSON document an API publishes at
- GlossaryOAuth Client ID Metadata Document (CIMD)
An OAuth Client ID Metadata Document (CIMD) is a JSON document of client metadata hosted at an HTTPS URL that the client uses as its `client_id`, so an authoriz
- BlogSAP Cloud SDK for Python flaw sends OAuth client secrets to attackers
CVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the clie
Technique
This CVE is an instance of Cross-tenant token confusion. A broker sitting between users and a shared backend fails to keep sessions apart, so a token supplied by one caller gets used to serve a different caller's later request, with no attack step beyond timing.