Skip to content
Fencer Vulns
medium 4.7

CVE-2024-39694 json

Duende IdentityServer Open Redirect vulnerability

published 2024-07-31 2 y ago modified 2026-06-17 4 mo ago also GHSA-ff4q-64jc-gx98 , EUVD-2024-2334

cvss
4.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use `IUrlHelper.IsLocalUrl` from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host.

Patch / fix

  • nuget Duende.IdentityServer 6.0.5, 6.1.8, 6.2.5, 6.3.10, 7.0.6

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
GitHub 3.1 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
nuget Duende.IdentityServer
>=7.0.0-preview.1, <7.0.6
>=6.3.0-preview.1, <6.3.10
>=6.2.0-preview.1, <6.2.5
>=6.1.0-preview.1, <6.1.8
>=6.0.0-preview.1, <6.0.5
7.0.6
6.3.10
6.2.5
6.1.8
6.0.5
nuget IdentityServer4
<=4.1.2
 no fix listed

Affected products

  • DuendeSoftware IdentityServer

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.