CVE-2024-51987 Overview
CVE-2024-51987 is a privilege management flaw [CWE-270] in Duende.AccessTokenManagement.OpenIdConnect, a set of .NET libraries that manage OAuth and OpenID Connect access tokens. HTTP clients created with AddUserAccessTokenHttpClient can send one user's refreshed access token on requests belonging to a different user. The token is captured inside pooled HttpClient instances and later reused across sessions. The vendor addressed the issue in Duende.AccessTokenManagement.OpenIdConnect 3.0.1.
Critical Impact
Cross-user access token leakage can allow one authenticated user to act with another user's OAuth credentials against downstream APIs, breaking tenant and session isolation.
Affected Products
- Duende.AccessTokenManagement.OpenIdConnect versions prior to 3.0.1
- .NET applications using AddUserAccessTokenHttpClient for pooled HttpClient creation
- Downstream OAuth/OpenID Connect-protected APIs consumed through the affected clients
Discovery Timeline
- 2024-11-08 - CVE-2024-51987 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-51987
Vulnerability Analysis
The library provides AddUserAccessTokenHttpClient as a convenience method for producing an HttpClient that automatically attaches the current user's managed OAuth access token to outbound requests. The resulting clients are drawn from the standard .NET HttpClient pool via IHttpClientFactory. When a token refresh occurs for user A, the refreshed token is bound to the pooled handler rather than the request scope.
When the same pooled handler is later served to a request executing for user B, the outbound request carries user A's Authorization: Bearer header. Downstream APIs then process the call under the wrong principal. The impact is confidentiality and integrity loss on any resource the leaked token can reach, without breaking availability.
Root Cause
The root cause is a scope mismatch between per-user token state and pool-scoped HttpClient handlers, which the CWE-270 mapping (Privilege Context Switching Error) reflects. Refreshed tokens are cached against the shared handler instance instead of the calling user's context.
Attack Vector
Exploitation is network-based and requires user interaction, in the form of concurrent or subsequent authenticated sessions through the affected application. An attacker who is a legitimate user of the application can receive another user's access token when the runtime hands them a pooled client whose handler already captured a refreshed token. No authentication bypass, memory corruption, or exploit code is required; the condition arises during normal application traffic. No known public exploit is available.
Detection Methods for CVE-2024-51987
Indicators of Compromise
- Downstream API logs showing requests where the sub claim inside the bearer token does not match the authenticated session or user identifier on the calling application.
- Access token jti values appearing in requests attributed to more than one distinct user account.
- Audit trails on protected resources showing actions performed by users who never initiated those actions in the client application.
Detection Strategies
- Inventory .NET services that reference Duende.AccessTokenManagement.OpenIdConnect and flag versions earlier than 3.0.1 in build manifests and SBOMs.
- Grep application code for AddUserAccessTokenHttpClient usage and correlate with IHttpClientFactory registrations to identify at-risk call sites.
- Correlate identity provider token issuance events with downstream API access logs to detect token reuse across user sessions.
Monitoring Recommendations
- Enable structured logging of token subject claims at API gateways and compare against upstream session identity on each request.
- Alert when the same access token is presented from sessions tied to different user principals within a short time window.
- Track anomalous OAuth refresh patterns from services that depend on the affected library.
How to Mitigate CVE-2024-51987
Immediate Actions Required
- Upgrade Duende.AccessTokenManagement.OpenIdConnect to version 3.0.1 or later across all affected .NET services.
- Replace AddUserAccessTokenHttpClient usage with per-request token acquisition via HttpContext.GetUserAccessTokenAsync or IUserTokenManagementService.GetAccessTokenAsync.
- Rotate or revoke any access and refresh tokens that may have been issued and cached during the vulnerable window.
Patch Information
The vendor fix is available in Duende.AccessTokenManagement.OpenIdConnect 3.0.1. Details and remediation guidance are published in the GitHub Security Advisory GHSA-7mr7-4f54-vcx5.
Workarounds
- No workarounds exist within the vulnerable versions; the vendor advisory instructs all users to upgrade.
- As a code-level alternative, stop using AddUserAccessTokenHttpClient and instead obtain tokens per request through HttpContext.GetUserAccessTokenAsync or IUserTokenManagementService.GetAccessTokenAsync, then attach the returned token manually to a non-pooled request.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
