CVE-2024-39694
Duende IdentityServer Open Redirect vulnerability
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Note: by itself, this vulnerability does **not** allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials. This vulnerability is fixed in 7.0.6, 6.3.10, 6.2.5, 6.1.8, and 6.0.5. Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates. If upgrading is not possible, use `IUrlHelper.IsLocalUrl` from ASP.NET Core to validate return Urls in user interface code in the IdentityServer host.
Timeline
ID reserved
By GitHub_M
- 34 days later
· 34 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| NVDNVD · Deferred | 3.1 | Medium4.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.
Weakness
Affected products
DuendeSoftware · IdentityServer
- affected < 6.0.5
- affected >= 6.1.0-preview.1, <= 6.1.7
- affected >= 6.2.0-preview.1, <= 6.2.4
- affected >= 6.3.0-preview.1, <= 6.3.9
- affected >= 7.0.0-preview.1, <= 7.0.5
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- NuGetDuende.IdentityServerGHSA-ff4q-64jc-gx98 (opens in a new tab)
- NuGetIdentityServer4GHSA-ff4q-64jc-gx98 (opens in a new tab)
References (6)
- https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98 (opens in a new tab)x_refsource_CONFIRM
- https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6 (opens in a new tab)x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e (opens in a new tab)x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1 (opens in a new tab)x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011 (opens in a new tab)x_refsource_MISC
- https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-ff4q-64jc-gx98 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-39694)Record last updated .