Back in 2017 we announced the end of IdentityServer3 maintenance. This excluded security bug fixes.

As of the 1st of July 2019 Microsoft officially ended support for Katana 3. This means that the platform we originally built-against is now unsupported and we completely stop supporting IdentityServer3 (including security bugs) for free now as well.

If you are still running IdentityServer3, you can get commercial support from us to further receive security notifications and updates and support in general. Or we can help you upgrading to ASP.NET Core and IdentityServer4. Contact us.