A flaw in Duende IdentityServer4 allows an attacker to supply a crafted id_token_hint to the /connect/authorize token renewal endpoint, resulting in improper authentication. The vulnerability can lead an attacker to obtain authenticated sessions or elevated privileges under the guise of a legitimate user, potentially compromising user data and application security. It is a moderate severity issue with a CVSS base score of 6.3.

Duende IdentityServer4 versions up to and including 4.1.2 are affected. Systems running these unsupported releases are at risk; no specific downstream products are listed.

The attack can be launched remotely, with high complexity and described as difficult to exploit. EPSS is below 1 %, indicating a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, because the affected software is no longer supported, any exploitation would go unpatched unless the vendor releases an update.