Race Condition in Duende.AccessTokenManagement Affects Access Token Requests

CVE-2025-26620

What is CVE-2025-26620?

Duende.AccessTokenManagement is a set of .NET libraries that facilitates OAuth and OpenId Connect access token management. A race condition arises during the client credentials flow when concurrent requests for access tokens utilize differing protocol parameters, potentially resulting in access tokens that are incorrectly scoped or associated with unintended resources. This issue is most likely to impact advanced users who make customized calls to HttpContext.GetClientAccessTokenAsync() or IClientCredentialsTokenManagementService.GetAccessTokenAsync() with varied TokenRequestParameters. Users should update the NuGet package to the latest version to mitigate this vulnerability. Additionally, custom implementations of IClientCredentialsTokenCache will require code adjustments to align with the new constructor dependency. The risk posed by incorrect access tokens can vary significantly based on the specific application logic and security policies of the involved resource servers.

References