{"action":"Upgrade Duende.AccessTokenManagement to 3.2.0 or later.","affected":[{"fixed":"3.2.0","introduced":"0"}],"component":"Duende.AccessTokenManagement","cve_ids":["CVE-2025-26620"],"ecosystem":"NuGet","epss":0.00392,"exploited":false,"fixed_versions":["3.2.0"],"ghsa_id":"GHSA-qxj7-2x7w-3mpp","id":"tcs_01M5N8Z7W5EAD1PXBA2GSHZ7JK","modified_at":"2025-02-19T18:12:52.158398Z","published_at":"2025-02-19T17:47:19Z","references":["https://osv.dev/vulnerability/GHSA-qxj7-2x7w-3mpp","https://github.com/DuendeSoftware/foss/security/advisories/GHSA-qxj7-2x7w-3mpp","https://nvd.nist.gov/vuln/detail/CVE-2025-26620","https://github.com/DuendeSoftware/foss/commit/a33332ddec0ebf3c048ba85427e3c77d47c68dac","https://github.com/DuendeSoftware/foss"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-qxj7-2x7w-3mpp","url":"https://osv.dev/vulnerability/GHSA-qxj7-2x7w-3mpp"}],"summary":"Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens"}