DuendeSoftware/products is-7.4.14

Duende IdentityServer 7.4.14

on GitHub

This release moves IdentityServer's dependencies onto the .NET October 2026 security updates, and fixes an exception during access token validation.

Update your .NET runtime

Most of the October 2026 .NET vulnerabilities are in the ASP.NET Core shared framework, so upgrading IdentityServer doesn't fix them. Update every IdentityServer host and container image to the October 2026 .NET runtime for the .NET version you run. For IdentityServer, the most important fixes are:

• Kestrel: HTTP/1 request smuggling (CVE-2026-88092) and HTTP/2 header handling (CVE-2026-70188), both critical.
• Request parsing: denial-of-service fixes for form and multipart parsing (CVE-2026-70181, CVE-2026-70196), which IdentityServer's protocol endpoints use for unauthenticated form posts.
• ASP.NET Core Identity: password reset and confirmation emails now go to the user's stored address (CVE-2026-70175). If your login UI implements its own reset flow, check that it does the same.

See Microsoft's .NET security announcements for the full list.

What's changed

• Dependencies: the minimum versions of the ASP.NET Core dependencies are raised to the October 2026 patched releases.
• Access token validation: a JWT access token that has a sub claim but no resolvable client is now rejected with invalid_token, instead of throwing during user activity validation. Tokens with neither sub nor client_id, and valid tokens with a client, are validated as before.

Upgrade notes

None.

Full Changelog: is-7.4.13...is-7.4.14