CVE-2025-26620: 
C# vulnerability analysis and mitigation

Duende.AccessTokenManagement, a set of .NET libraries that manage OAuth and OpenId Connect access tokens, contains a race condition vulnerability (CVE-2025-26620) discovered in February 2025. The vulnerability affects versions 3.1.1 and earlier, where concurrent requests to obtain an access token using the client credentials flow with differing protocol parameters can return access tokens obtained with incorrect scope, resource indicator, or other protocol parameters (GitHub Advisory).

The vulnerability occurs when using specific overloads of methods HttpContext.GetClientAccessTokenAsync() and IClientCredentialsTokenManagementService.GetAccessTokenAsync() that accept a TokenRequestParameters object for customizing token request parameters. When concurrent requests are made with varying TokenRequestParameters, the race condition causes the same token to be returned for all concurrent calls, regardless of the different parameters specified (GitHub Advisory). The vulnerability has been assigned a CVSS v4.0 base score of 6.3 (Medium) with vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N (NVD).

The impact varies depending on how Duende.AccessTokenManagement is used and the security architecture of the solution. While most users are not vulnerable to this issue, advanced users who call the affected methods with customized token request parameters may receive tokens with incorrect scopes or parameters. The severity of obtaining an access token with different than intended protocol parameters depends on application logic, security architecture, and the authorization policy of the resource servers (GitHub Advisory).

The vulnerability has been patched in version 3.2.0. Most users can simply update the NuGet package to the latest version. For users with customizations of the IClientCredentialsTokenCache that derive from the default implementation (DistributedClientCredentialsTokenCache), a small code change is required. The constructor was changed to add a dependency on the ITokenRequestSynchronization service, which needs to be injected into the derived class and passed to the base constructor (GitHub Advisory).

The vulnerability was responsibly disclosed by Michael Dimoudis of PageUp, leading to a coordinated response and patch release (GitHub Advisory).