← Back

Identityserver4

identityserver4

Vendor: Identityserver • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-12250
1Identityserver
1Identityserver4
Jun 17, 2026
May 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maint...Show more
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the request logger is not part of IdentityServer but only our development test hostShow less
CVE-2018-8899
1Identityserver
1Identityserver4
Jun 17, 2026
Mar 22, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.