GHSA-494h-xx7x-5frh CVE-2026-70183
Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.53%
- Chance of exploitation in the next 30 days. Higher than 44.90% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- Fix
- Available
- 12 packages have a fixed version
Description
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A stale asynchronous authorization result in Blazor AuthorizeRouteView can be applied after navigation or an authorization-state change, bypassing the current [Authorize] decision.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/460
CVSS Details
- Version: 3.1
- Severity: High
- Score: 7.5
- Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
Affected Platforms
- Platforms: Windows, Linux, macOS
- Architectures: All
<a name="affected-packages"></a>Affected Packages
The vulnerability affects Microsoft .NET projects that use an affected package version listed below.
Advisory FAQ
<a name="how-affected"></a>How do I know if I am affected?
If using a package listed in affected packages, you're exposed to the vulnerability.
<a name="how-fix"></a>How do I fix the issue?
- To fix the issue please install the latest version of .NET. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.
- If your application references the vulnerable package, update the package reference to the patched version. You can list the versions you have installed by running the
dotnet --infocommand.
Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.
Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.
Other Information
Reporting Security Issues
If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the MSRC Researcher Portal. Further information can be found in the MSRC Report an Issue FAQ.
Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.
Support
You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.
Disclaimer
The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
External Links
Acknowledgements
- l8BL with ENKI WhiteHat (https://enki.co.kr/)
Revisions
V1.0 (10/13/2026): Advisory published.
Affected versions
NuGet
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
Microsoft.AspNetCore.App.Runtime.linux-arm NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm --version 8.0.32
Microsoft.AspNetCore.App.Runtime.linux-arm64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.linux-arm64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-arm NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm --version 8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.linux-musl-x64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.linux-musl-x64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.linux-x64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.linux-x64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.osx-arm64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.osx-arm64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.osx-x64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.osx-x64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.win-arm NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm --version 8.0.32
Microsoft.AspNetCore.App.Runtime.win-arm64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.win-arm64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.win-x64 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.win-x64 --version 8.0.32
Microsoft.AspNetCore.App.Runtime.win-x86 NuGet → 8.0.32
- dotnet
dotnet add package Microsoft.AspNetCore.App.Runtime.win-x86 --version 8.0.32
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How to prevent it
- Architecture and Design: In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
- Architecture and Design: Use thread-safe capabilities such as the data access abstraction in Spring.
- Architecture and Design: Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
- Implementation: When using multithreading and operating on shared variables, only use thread-safe functions.
- Implementation: Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
- Implementation: Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
- Implementation: Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
- Implementation: Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
- Implementation: Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
- Architecture and Design, Operation: Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vmch-3w2x-vhgq .NET Denial of Service Vulnerability | High Known exploited | Also affects Microsoft.AspNetCore.App.Runtime.win-arm64 |
| GHSA-f4g7-52wc-p8x7 Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability | High | Also affects Microsoft.AspNetCore.App.Runtime.linux-arm |
| GHSA-rv87-ccxw-8ggf Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability | Critical | Also affects Microsoft.AspNetCore.App.Runtime.linux-arm |
| GHSA-57xr-hfxx-jw5x Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability | Medium | Also affects Microsoft.AspNetCore.App.Runtime.linux-arm |
| GHSA-fpq8-4vhr-rcxx Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability | Critical | Also affects Microsoft.AspNetCore.App.Runtime.linux-arm |
| GHSA-mf4x-w4gh-4656 Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability | High | Also affects Microsoft.AspNetCore.App.Runtime.linux-arm |
| GHSA-w5qq-qrpp-rf4c Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability | High | Also affects Microsoft.AspNetCore.App.Runtime.linux-arm |
| GHSA-x3vp-85cm-q97r Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability | High | Also affects Microsoft.AspNetCore.App.Runtime.linux-arm |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor