DuendeSoftware/products is-8.0.10

Duende IdentityServer 8.0.10

on GitHub

This release moves IdentityServer's dependencies onto the .NET October 2026 security updates, and fixes an exception during access token validation.

Update your .NET runtime

Most of the October 2026 .NET vulnerabilities are in the ASP.NET Core shared framework, so upgrading IdentityServer doesn't fix them. Update every IdentityServer host and container image to the October 2026 .NET runtime. For IdentityServer, the most important fixes are:

• SAML: five Signed XML denial-of-service fixes (CVE-2026-58280, CVE-2026-69651, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960). IdentityServer's SAML endpoints validate and decrypt XML before anyone signs in. System.Security.Cryptography.Xml loads from the shared framework, so these fixes come from the runtime, not from this package.
• Kestrel: HTTP/1 request smuggling (CVE-2026-88092) and HTTP/2 header handling (CVE-2026-70188), both critical.
• Request parsing: denial-of-service fixes for form and multipart parsing (CVE-2026-70181, CVE-2026-70196), which IdentityServer's protocol endpoints use for unauthenticated form posts.
• ASP.NET Core Identity: password reset and confirmation emails now go to the user's stored address (CVE-2026-70175). If your login UI implements its own reset flow, check that it does the same.

See Microsoft's .NET security announcements for the full list.

What's changed

• Dependencies: the minimum versions of the ASP.NET Core and Microsoft.IdentityModel dependencies are raised to the October 2026 patched releases.
• Access token validation: a JWT access token that has a sub claim but no resolvable client is now rejected with invalid_token, instead of throwing a NullReferenceException during user activity validation. Tokens without a sub claim, including custom JWTs issued without a client, are unaffected.

Upgrade notes

None.

Full Changelog: is-8.0.9...is-8.0.10