CVE-2025-11850 in Identity Server
Summary
by MITRE • 08/06/2026
When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store.
If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability represents a critical identity management flaw that undermines the integrity of user authentication systems when multiple user stores are configured within a single identity provider environment. The issue stems from an improper initialization sequence within the implicit-association resolver component, which fails to properly prioritize the primary user store during identity resolution processes. When secondary user stores are present, the system incorrectly initializes from these secondary sources rather than maintaining proper precedence for the primary store, creating a dangerous condition where user identity associations can become arbitrarily determined by whichever store happens to contain the matching claim value first.
The technical root cause of this vulnerability lies in the flawed logic governing how the implicit-association resolver handles multi-store environments, specifically violating fundamental security principles around privilege escalation and access control. According to CWE-284 Access Control Bypass, this flaw creates an unauthorized access condition where users may be incorrectly associated with accounts in secondary stores rather than their intended primary accounts. The vulnerability manifests when duplicate claim values such as usernames or email addresses exist across both primary and secondary user stores, allowing for confusion during authentication processes that can result in unauthorized access or account takeover scenarios.
The operational impact of this vulnerability extends beyond simple identity confusion to potentially compromise entire authentication workflows within affected systems. When external Identity Providers are involved, the issue becomes particularly dangerous as legitimate users in the primary store may find their accounts incorrectly associated with secondary accounts that have different privilege levels or security configurations. This can result in access restrictions where users lose privileges they should legitimately possess, or conversely, unauthorized users may gain access to systems through compromised secondary account associations. The vulnerability affects authentication flows where implicit associations are enabled and multiple user stores are configured, creating a potential attack surface for adversaries seeking to exploit identity management weaknesses.
Security mitigation strategies must address both the immediate configuration issues and broader architectural concerns within identity management systems. Organizations should ensure that primary user stores maintain proper precedence in all association resolution processes, implement strict claim value uniqueness controls across all user stores, or disable implicit associations when multiple stores are present. The ATT&CK framework's T1566 Credential Access techniques highlight how such vulnerabilities can be exploited for unauthorized access, making this particularly concerning for environments with external identity providers where the attack surface expands significantly. Deployment configurations should be audited to verify that either no secondary user stores exist, implicit associations are disabled, or claim values are globally unique across all configured stores. Additionally, implementing proper monitoring and logging of identity association events can help detect anomalous behavior that might indicate exploitation attempts, while regular security assessments should validate that the implicit-association resolver correctly prioritizes primary user store initialization over secondary configurations.