CVE-2026-70183
Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability
Published Oct 13, 2026
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A stale asynchronous authorization result in Blazor AuthorizeRouteView can be applied after navigation or an authorization-state change, bypassing the current [Authorize] decision.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · GitLab Advisory Database
Detected
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A stale asynchronous authorization result in Blazor AuthorizeRouteView can be applied after navigation or an authorization-state change,
Affected
- nuget microsoft.aspnetcore.app.runtime.linux-armversion unspecified
- nuget microsoft.aspnetcore.app.runtime.linux-arm64version unspecified
- nuget microsoft.aspnetcore.app.runtime.linux-musl-armversion unspecified
- nuget microsoft.aspnetcore.app.runtime.linux-musl-arm64version unspecified
- nuget microsoft.aspnetcore.app.runtime.linux-musl-x64version unspecified
- nuget microsoft.aspnetcore.app.runtime.linux-x64version unspecified
- nuget microsoft.aspnetcore.app.runtime.osx-arm64version unspecified
- nuget microsoft.aspnetcore.app.runtime.osx-x64version unspecified
- nuget microsoft.aspnetcore.app.runtime.win-armversion unspecified
- nuget microsoft.aspnetcore.app.runtime.win-arm64version unspecified
- nuget microsoft.aspnetcore.app.runtime.win-x64version unspecified
- nuget microsoft.aspnetcore.app.runtime.win-x86version unspecified
Sources
- CVE.orgCVE-2026-70183
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-70183
30-day exploitation probability 0.5%
first.org - GitLab Advisory DatabaseCVE-2026-70183
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A stale asynchronous authorization result in Blazor AuthorizeRouteView can be applied after navigation or an authorization-state change,
advisories.gitlab.com