CVE-2024-21643 — Vulnerability in...
HIGH
Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability
Published January 9, 2024Updated September 10, 2026Source: osv
Summary
### Impact
_What kind of vulnerability is it? Who is impacted?_
Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users **should** update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, if using Microsoft.IdentityModel.Protocols.SignedHttpRequest.
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
No, users must upgrade.
### References
_Are there any links users can visit to find out more?_
https://aka.ms/IdentityModel/Jan2024/jku
Advisory Timeline
- First published January 9, 2024 (1007 days ago).
- Last revised September 10, 2026 — 974 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
NuGet
Update Microsoft.IdentityModel.Protocols.SignedHttpRequest to 7.1.2 or laterdotnet add package Microsoft.IdentityModel.Protocols.SignedHttpRequest --version 7.1.2
NuGet
Update Microsoft.IdentityModel.Protocols.SignedHttpRequest to 6.34.0 or laterdotnet add package Microsoft.IdentityModel.Protocols.SignedHttpRequest --version 6.34.0
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (2)
Affects 1 ecosystem: nuget (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| Microsoft.IdentityModel.Protocols.SignedHttpRequest | nuget | 7.0.0, 7.0.0-preview, 7.0.0-preview2, 7.0.0-preview3 (+6 more) | 7.1.2 |
| Microsoft.IdentityModel.Protocols.SignedHttpRequest | nuget | 6.10.0, 6.10.1, 6.10.2, 6.11.0 (+45 more) | 6.34.0 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-94Code InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.1 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
References
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5hWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-21643ADVISORY
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnetPACKAGE
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0WEB
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2WEB
- https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/wiki/jkucveWEB
Frequently Asked Questions
- What is CVE-2024-21643?
- Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.1/10).
- How do I check if my project is affected by CVE-2024-21643?
- CVE-2024-21643 affects Microsoft.IdentityModel.Protocols.SignedHttpRequest. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-21643 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.1
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-rv9j-c866-gp5h
Related CVEs
- CVE-2026-106112HIGH
ImageSharp: ICC LUT16 output channel count can write beyond Vector4
- CVE-2026-106115HIGH
ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output buffer
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies