ASP.NET Core: Improper authentication enables privilege escalation

Summary

Improper authentication in ASP.NET Core allows an unauthorized remote attacker to elevate privileges. Identity password-reset and confirmation mails can be sent to an unvalidated request address instead of the address stored on the user account, which can lead to account takeover. The risk is mainly for internet-facing apps that use the default Identity UI pages with working email sending; attack complexity is high and no privileges are required.

Affected

• Microsoft ASP.NET Core 8.0: 8.0.0 to before 8.0.32
• Microsoft ASP.NET Core 9.0: 9.0.0 to before 9.0.21
• Microsoft ASP.NET Core 10.0: 10.0.0 to before 10.0.13
• Microsoft Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.42
• Microsoft Visual Studio 2026 version 18.10: 18.10.0 to before 18.10.4
• Affected components: Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI
• .NET 6 and .NET 7: unknown, no Microsoft fix found

Fixed in

• ASP.NET Core 8.0.32 or later (.NET 8.0.32 Runtime or .NET 8.0.426 SDK)
• ASP.NET Core 9.0.21 or later (.NET 9.0.21 Runtime or .NET 9.0.319 SDK)
• ASP.NET Core 10.0.13 or later (.NET 10.0.13 Runtime or .NET 10.0.402 SDK)
• Visual Studio 2022 17.14.42 or later; Visual Studio 2026 18.10.4 or later

Workaround

• No official workaround found. The vendor fix is the patch.
• Applications that copied the Identity UI pages into their own source must apply the change manually.
• Until patched (own assessment, not from a source): verify that password-reset and confirmation handlers send mail only to the address stored on the user account.

Exploitation

• No public proof of concept found; Microsoft lists publicly disclosed: No.
• No evidence of exploitation in the wild found. CISA SSVC lists exploitation: none and automatable: no.
• KEV status not confirmed.

Our recommendation

• Identify internet-facing .NET 8, 9 or 10 web applications that use ASP.NET Core Identity, including self-service password reset.
• Update the runtime, SDK and application builds to 8.0.32, 9.0.21 or 10.0.13 or later, and update any Identity.UI NuGet reference.
• Check copied or scaffolded Identity UI code and correct it manually.
• Check the database collation of the user store, since loose email comparison increases the risk.
• Plan migration for out-of-support .NET versions, as no fix is confirmed for them.
• Monitor password-reset activity and mail logs for unusual requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-70175 msrc.microsoft.com
• Microsoft Security Update Guide (en-US): CVE-2026-70175 msrc.microsoft.com
• Red Hat CVE page: CVE-2026-70175 access.redhat.com
• Red Hat Bugzilla: CVE-2026-70175 bugzilla.redhat.com
• OSV: Ubuntu CVE-2026-70175 osv.dev
• GitLab Advisory: CVE-2026-70175 advisories.gitlab.com
• HeroDev Vulnerability Directory: CVE-2026-70175 www.herodevs.com
• OpenCVE: CVE-2026-70175 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:32.