CVE-2024-21643: Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-10 · updated 2026-06-17
Weakness: CWE-94

Description

IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher.

Affected products

AzureAD azure-activedirectory-identitymodel-extensions-for-dotnet: before 6.34.0; from 7.0.0 before 7.1.2 — fixed in 6.34.0, 7.1.2
AzureAD azure-activedirectory-identitymodel-extensions-for-dotnet: before 6.34.0; from 7.0.0-preview, < 7.1.2

How to fix

Upgrade to a fixed version: AzureAD azure-activedirectory-identitymodel-extensions-for-dotnet 6.34.0, 7.1.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21643 or the next vulnerability affects your stack