CVE-2026-47303

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications. ASP.NET Core extends the .NET developer platform with tools and libraries specifically for building web apps. ASP.NET Core is the open-source version of ASP.NET, that runs on macOS, Linux, and Windows. ASP.NET Core was first released in 2016 and is a re-design of earlier Windows-only versions of ASP.NET.

A vulnerability (CVE-2026-47303) exists in the Negotiate authentication handler of ASP.NET Core, specifically in the nested Active Directory group resolution provided by the opt-in Microsoft.AspNetCore.Authentication.Negotiate package. When an application enables LDAP role-claim resolution with the default nested-group handling, the internal LdapAdapter resolves each nested group by taking the CN component of a memberOf distinguished name and searching for a group whose sAMAccountName equals that CN. Because CN and sAMAccountName are distinct and independently-settable Active Directory attributes, an authenticated attacker who can influence a group's name can create a group whose CN matches a privileged group's sAMAccountName, causing the lookup to resolve to the wrong directory object and attach the wrong role claims. This can allow role-based authorization decisions to be bypassed.

Per CWE-302: Authentication Bypass by Assumed-Immutable Data, the authentication scheme or implementation uses key data elements that are assumed to be immutable, but that can be controlled or modified by an attacker.

This issue affects ASP.NET Core 6.0.0 <= 6.0.42 in NES-supported environments. The vulnerable code ships only in the opt-in Microsoft.AspNetCore.Authentication.Negotiate NuGet package and is reached only when LDAP role-claim resolution is enabled with nested-group handling left at its default, so the shared ASP.NET Core framework alone neither delivers nor remediates it and affected applications must update the package reference. 

‍

Details

Module Info

• Product:
  
  • Any ASP.NET Core 6.0 application that references Microsoft.AspNetCore.Authentication.Negotiate 6.0.42 or earlier and enables LDAP role-claim resolution.
• Affected packages:
  
  • Microsoft.AspNetCore.Authentication.Negotiate
• Affected versions:
  
  • >= 6.0.0 <= 6.0.42
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Package manager:
  
  • NuGet
• Fixed in: NES for .NET 6.0.43

Vulnerability Info

This High-severity vulnerability is found in the Microsoft.AspNetCore.Authentication.Negotiate package used with ASP.NET Core Negotiate authentication. When LDAP role-claim resolution is enabled and nested-group handling is left at its default (LdapSettings.IgnoreNestedGroups is false), the LdapAdapter walks each memberOf distinguished name of the authenticated user and resolves nested groups recursively. For each group it extracts the CN portion of the distinguished name and then searches the directory for a group whose sAMAccountName equals that CN. CN and sAMAccountName are separate attributes that an Active Directory administrator or a delegated low-privileged user can set independently, so a group whose CN collides with a privileged group's sAMAccountName resolves to the wrong object and the wrong role claims are attached to the caller. The resolved claims are also cached per user, which extends the window of the incorrect authorization state.

var groupCN = groupDN.Split(',')[0].Substring("CN=".Length);
...
var filter = $"(&(objectClass=group)(sAMAccountName={groupCN}))";
var searchRequest = new SearchRequest(distinguishedName, filter, SearchScope.Subtree, null);

This vulnerability was introduced in 2020 with ASP.NET Core 5.0.

‍

Mitigation

ASP.NET Core 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • Microsoft.AspNetCore.Authentication.Negotiate >= 8.0.29
  • Microsoft.AspNetCore.Authentication.Negotiate >= 9.0.18
  • Microsoft.AspNetCore.Authentication.Negotiate >= 10.0.10
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.43 or later.

‍

Credits

Microsoft credits Pham Quang Minh for reporting this vulnerability.