[Bug] `ArgumentNullException` in `TokenValidator` #609

aomader · 2026-08-13T12:51:01Z

aomader
Aug 13, 2026

We are seeing ArgumentNullExceptions in our logs originating from within the TokenValidator.

Stack trace:

System.ArgumentNullException: Value cannot be null. (Parameter 'client')
   at System.ArgumentNullException.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Validation.TokenValidator+<ValidateAccessTokenAsync>d__13.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at ...
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Validation.UserInfoRequestValidator+<ValidateRequestAsync>d__5.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null: /_/identity-server/src/IdentityServer/Validation/Default/UserInfoRequestValidator.cs:56)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Endpoints.UserInfoEndpoint+<ProcessUserInfoRequestAsync>d__6.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null: /_/identity-server/src/IdentityServer/Endpoints/UserInfoEndpoint.cs:82)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Endpoints.UserInfoEndpoint+<ProcessAsync>d__5.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null: /_/identity-server/src/IdentityServer/Endpoints/UserInfoEndpoint.cs:61)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Hosting.IdentityServerMiddleware+<Invoke>d__3.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null: /_/identity-server/src/IdentityServer/Hosting/IdentityServerMiddleware.cs:100)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Hosting.MutualTlsEndpointMiddleware+<Invoke>d__7.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null: /_/identity-server/src/IdentityServer/Hosting/MutualTlsEndpointMiddleware.cs:125)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware+<Invoke>d__6.MoveNext (Microsoft.AspNetCore.Authentication, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Hosting.DynamicProviders.DynamicSchemeAuthenticationMiddleware+<Invoke>d__3.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null: /_/identity-server/src/IdentityServer/Hosting/DynamicProviders/DynamicSchemes/DynamicSchemeAuthenticationMiddleware.cs:57)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Duende.IdentityServer.Hosting.BaseUrlMiddleware+<Invoke>d__2.MoveNext (Duende.IdentityServer, Version=7.0.0.0, Culture=neutral, PublicKeyToken=null: /_/identity-server/src/IdentityServer/Hosting/BaseUrlMiddleware.cs:23)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Microsoft.AspNetCore.Builder.Extensions.MapMiddleware+<InvokeCore>d__4.MoveNext (Microsoft.AspNetCore.Http.Abstractions, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at ...
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions+InterfaceMiddlewareBinder+<>c__DisplayClass2_0+<<CreateMiddleware>b__0>d.MoveNext (Microsoft.AspNetCore.Http.Abstractions, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at ...
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Microsoft.AspNetCore.Builder.UseMiddlewareExtensions+InterfaceMiddlewareBinder+<>c__DisplayClass2_0+<<CreateMiddleware>b__0>d.MoveNext (Microsoft.AspNetCore.Http.Abstractions, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification (System.Private.CoreLib, Version=10.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddlewareImpl+<<Invoke>g__Awaited|10_0>d.MoveNext (Microsoft.AspNetCore.Diagnostics, Version=10.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)

From what I can see, the only place where that ArgumentNullException can originate from is in the call to the constructor of IsActiveContext(), where the result.Client is passed, since that throws in case the client is null.

That begs the question, why is it null in the first place? Looking at the ValidateJwtAsync() method that is used to construct the result. It seems that it sets Client to null in case no client_id claim is present.

However, that should instead be an error, shouldn't it? Given that the spec defines client_id as mandatory.

Answered by StuFrankish

Sep 29, 2026

Hi @aomader 👋

We've taken a look and can successfully reproduce the bug, found in the TokenValidator.
We'll be raising a fix for this shortly.

Many thanks for the report!

View full answer

ProgrammerAL · 2026-08-13T19:56:26Z

ProgrammerAL
Aug 13, 2026
Maintainer

@aomader, The client_id field is parsed from the JWT given to IdentityServer. After parsing, it’s validated to ensure it has all required fields. The ArgumentNullException is thrown to enforce the error, like you mentioned in the spec for RFC9068. Since the null reference exception is not very descriptive, Duende IdentityServer 8.0.1 added an explicit check for this and now throws a NullReferenceException with the error message "result.Client is null" when this occurs.

If the JWT is created by an external provider, it could be leaving off the client_id property. I’d recommend checking the provider’s documentation to see which cases cause a JWT to not have a client_id claim.

If the JWT is generated by Duende IdentityServer, and you need help troubleshooting why it isn’t adding the client_id claim, can you please provide us:

Which version of IdentityServer are you using?
What types customizations you’ve added? Specifically around functionality overrides like maybe IUserInfoRequestValidator. Any code you can share would be helpful.

4 replies

aomader Aug 21, 2026
Author

Hej @ProgrammerAL, thanks for coming back.

Let me first answer your questions:

Given that the signing keys are being validated, I would assume they were generated IdentityServer, we are using version 7.4.11
No, we did not modify anything around IUserInfoRequestValidator

Independent of who generated that token, there should not surface an exception. Instead, a proper error result should be returned in case the client_id is missing. This is a public API that should handle those errors gracefully.

ProgrammerAL Aug 24, 2026
Maintainer

@aomader, sorry I misunderstood. I spoke with the engineering team and they agree a better approach is needed here. I will update this thread when a release contains a change for this issue.

aomader Sep 21, 2026
Author

@ProgrammerAL Any update?

ProgrammerAL Sep 22, 2026
Maintainer

Sorry for taking a while to respond. This is still on the backlog, but the team is looking at it right now. I hope to have an update for you soon.

StuFrankish · 2026-09-29T10:33:22Z

StuFrankish
Sep 29, 2026
Maintainer

Hi @aomader 👋

We've taken a look and can successfully reproduce the bug, found in the TokenValidator.
We'll be raising a fix for this shortly.

Many thanks for the report!

0 replies

ProgrammerAL · 2026-09-29T18:14:20Z

ProgrammerAL
Sep 29, 2026
Maintainer

@aomader, I was speaking with the development team regarding this issue. While looking through the code, they were thinking through different scenarios where this can happen. The team is working on this issue. But out of curiosity, how did you get a JWT without the client_id claim? Is it coming from an external identity provider? Or something generated locally?

1 reply

aomader Sep 30, 2026
Author

@ProgrammerAL As mentioned earlier, it must be some token that was generated by the IdentityServer.

Navigation Menu

Duende Software

[Bug] `ArgumentNullException` in `TokenValidator` #609

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Duende Software

[Bug] ArgumentNullException in TokenValidator #609

Uh oh!

aomader Aug 13, 2026

Replies: 3 comments · 5 replies

Uh oh!

ProgrammerAL Aug 13, 2026 Maintainer

Uh oh!

aomader Aug 21, 2026 Author

Uh oh!

ProgrammerAL Aug 24, 2026 Maintainer

Uh oh!

aomader Sep 21, 2026 Author

Uh oh!

ProgrammerAL Sep 22, 2026 Maintainer

Uh oh!

StuFrankish Sep 29, 2026 Maintainer

Uh oh!

ProgrammerAL Sep 29, 2026 Maintainer

Uh oh!

aomader Sep 30, 2026 Author

[Bug] `ArgumentNullException` in `TokenValidator` #609

aomader
Aug 13, 2026

Replies: 3 comments 5 replies

ProgrammerAL
Aug 13, 2026
Maintainer

aomader Aug 21, 2026
Author

ProgrammerAL Aug 24, 2026
Maintainer

aomader Sep 21, 2026
Author

ProgrammerAL Sep 22, 2026
Maintainer

StuFrankish
Sep 29, 2026
Maintainer

ProgrammerAL
Sep 29, 2026
Maintainer

aomader Sep 30, 2026
Author