← Back

Identityserver

identityserver

3 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Identityserver4
identityserver4
2 CVEs
Identityserver3
identityserver3
1 CVE

CVEs (3)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-12250
1Identityserver
1Identityserver4
Jun 17, 2026
May 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maint...Show more
IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log. NOTE: the software maintainer disputes that this is a vulnerability because the request logger is not part of IdentityServer but only our development test hostShow less
CVE-2018-8899
1Identityserver
1Identityserver4
Jun 17, 2026
Mar 22, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.
CVE-2017-12677
1Identityserver
1Identityserver3
May 13, 2026
Aug 8, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorizat...Show more
IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorization response.Show less