CVE-2026-114146

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An incorrect authorization vulnerability (CVE-2026-114146) exists in ASP.NET Core SignalR. Microsoft describes the issue as SignalR connections not being consistently bound to the identity negotiated when the connection was established, which lets an authorized attacker elevate privileges over a network by injecting messages that execute Hub invocations as the victim.

Per CWE-863: Incorrect Authorization, the weakness is a product performing an authorization check when an actor attempts to access a resource or perform an action, but not correctly performing the check.

The vulnerable code ships in the ASP.NET Core shared framework, so every .NET 6 ASP.NET Core version through NES for .NET 6.0.48 is affected on Windows, Linux, and macOS. Only applications that host SignalR hubs are exposed, and exploitation requires an authenticated attacker and an action by the victim. Microsoft also serviced ASP.NET Core 8.0, 9.0, 10.0, and 11.0 in its November 10, 2026 security updates.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: ASP.NET Core (SignalR)
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App, runtime packs Microsoft.AspNetCore.App.Runtime.<rid>), in-box; Microsoft.AspNetCore.Http.Connections 1.2.x (ASP.NET Core 2.3 only)
• Affected versions:
  • >= 6.0.0, <= 6.0.48 (NES for .NET 6)
  • >= 8.0.0-preview.1.23112.2, <= 8.0.33
  • >= 9.0.0-preview.1.24081.5, <= 9.0.22
  • >= 10.0.0-preview.1.25120.3, <= 10.0.14
  • >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148
  • Microsoft.AspNetCore.Http.Connections >= 1.2.0, <= 1.2.13
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET
• Fixed in: NES for .NET 6.0.49

Vulnerability Info

This Critical-severity vulnerability is found in the SignalR connection layer (Microsoft.AspNetCore.Http.Connections) of the ASP.NET Core shared framework.

A SignalR client first calls the hub's /negotiate endpoint, which creates a connection and returns a connection token, then opens a transport (WebSockets, Server-Sent Events, or long polling) that presents that token. The connection is meant to belong to the user who negotiated it. In affected versions, HttpConnectionDispatcher did not compare the user on later transport, send, and close requests with the negotiating user, and the first transport request's user became the connection's User. A request carrying another user's connection token could therefore act on that connection under a different identity, and messages injected this way ran Hub methods as the victim.

NES for .NET 6.0.49 applies Microsoft's fix: the identity captured at negotiation stays with the connection, and requests from a different user get HTTP 403 until the first transport request succeeds and binds the connection to its user.

This vulnerability has been present since at least ASP.NET Core 6.0, and Microsoft's fix for the ASP.NET Core 2.3 Microsoft.AspNetCore.Http.Connections 1.2.x package shows that it predates .NET 6.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  • ASP.NET Core Runtime >= 10.0.15
  • ASP.NET Core Runtime >= 11.0.0
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.49 or later.

Credits

Microsoft's advisory acknowledges the following for this vulnerability: Mika Vehns with MIVE GmbH, Lucas Gabriel, hsuan0223x, Mariusz Maik, Pocas (Jeongwon Jo), Grace Chapel, Jacob Keith with Keith Systems, Weeraphat Srisutham, Kevin Gosse, Artur Stetsko, Yudai Shibata, 71C4, Attila Csatadi of ZeroDayBugs.com, and Vu Van Tien (@n0_Be3r).