Key points
- The vulnerability affects ASP.NET Core versions 8, 9, and 10 on Windows, Linux, and macOS.
- Microsoft rates the issue as high severity with a CVSS score of 8.1.
- Patches are available in versions 8.0.32, 9.0.21, and 10.0.13.
An authentication flaw in Microsoft ASP.NET Core allows unauthorized users to elevate privileges by manipulating password-reset and confirmation flows. According to the Microsoft Security Update Guide, the defect resides in Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI components. Attackers can force the system to send sensitive tokens to an email address specified in the request, rather than the user's verified canonical address. This behavior enables privilege escalation over a network without prior authentication.
By the numbers
- CVSS 3.1 score of 8.1, classified as high severity.
- Three major product lines affected: ASP.NET Core 8, 9, and 10.
- Vulnerable version ranges span from initial releases through 8.0.31, 9.0.20, and 10.0.12.
What the figures mean
The high severity rating reflects the potential for complete account compromise. The GitHub advisory notes that the weakness aligns with CWE-640, which covers weak password recovery mechanisms. Because the flaw impacts identity verification, it affects applications relying on standard ASP.NET Core identity features across all supported architectures. Microsoft states that the issue allows an attacker to bypass intended security controls by redirecting critical communications. This exposure exists on Windows, Linux, and macOS platforms equally.
What to watch
Developers should verify which runtime packages their applications consume. The vulnerability affects specific NuGet packages, including Microsoft.AspNetCore.App.Runtime variants for Linux, macOS, and Windows. Teams must check if they are using versions prior to the patched releases. The advisory lists distinct affected ranges for each major version line. Applications using custom identity implementations may still be vulnerable if they depend on the underlying Microsoft.AspNetCore.Identity libraries. Monitoring dependency updates is essential for mitigation.
Infection and persistence in general
Teams usually investigate identity-related flaws by reviewing how applications handle user verification tokens. Analysts examine logs for unusual password-reset requests originating from unexpected sources or IP addresses. They check whether the application validates the destination email address against stored user records before sending sensitive data. Persistence in these cases often relies on the attacker gaining initial access to a valid account, then escalating privileges. Security operations should monitor for rapid succession of authentication events and unauthorized profile changes.
Background: Account takeover
Account takeover happens when attackers steal login credentials or session tokens to access your systems. Small teams are targeted because they often lack layered defenses. Protect yourself by enforcing multi-factor authentication, monitoring for unusual login patterns, and verifying identity through out-of-band channels before granting access.
Read the full guide: Account Takeover Risks and Low-Cost Defenses for Small Teams
What to do and how to stay safe: Microsoft
- Audit current ASP.NET Core versions and compare them against the patched versions listed in the advisory.
- Review application logs for password-reset attempts that do not match known user patterns or origins.
- Ensure that identity flows validate email addresses against canonical user data before sending tokens.
- Update NuGet packages to the latest secure versions once the vendor provides an update.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which ASP.NET Core versions are vulnerable to CVE-2026-70175?
Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, and 10.0.0 through 10.0.12 are affected.
Is there a patch available for this vulnerability?
Yes, Microsoft has released patches in versions 8.0.32, 9.0.21, and 10.0.13.
What is the CVSS score for this issue?
The vulnerability has a CVSS 3.1 score of 8.1, which is rated as high severity.
