CVE-2026-70175

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An account takeover vulnerability (CVE-2026-70175) has been identified in ASP.NET Core Identity UI. The password-reset and email-confirmation pages can send a user's link to the address the requester typed rather than the address stored on the account, so an attacker who supplies an address that matches someone else's account can receive that user's password-reset link.

Per CWE-640: Weak Password Recovery Mechanism for Forgotten Password, the weakness is a product containing a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

This issue affects ASP.NET Core 6.0 applications that use the default Identity UI pages from the Microsoft.AspNetCore.Identity.UI package with email sending configured, on Windows, Linux, and macOS. Exposure is greatest where the user store compares email addresses loosely, for example a database collation that ignores accents. Applications that scaffolded these pages into their own source carry their own copy and need the same change made by hand. The fix ships in the package, not the shared framework, so applications must update the package reference. Microsoft's advisory lists ASP.NET Core 8.0, 9.0 and 10.0 as affected; .NET 6 is past end of life and is not assessed there.

Details

Module Info

• Product: Any NES for .NET 6 ASP.NET Core application using Microsoft.AspNetCore.Identity.UI 6.0.46 or earlier with email-based password reset or confirmation.
• Affected packages: Microsoft.AspNetCore.Identity.UI (opt-in package, not in the shared framework)
• Affected versions:
  
  • Microsoft.AspNetCore.Identity.UI >= 6.0.0 <= 6.0.46
• Package manager: NuGet
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Microsoft.AspNetCore.Identity.UI on NuGet
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in the ForgotPassword and ResendEmailConfirmation pages of Microsoft.AspNetCore.Identity.UI, in both the Bootstrap 4 and Bootstrap 5 page sets.

Each page finds the account with FindByEmailAsync, which matches on the normalized email address, and then sends the reset or confirmation link. Before the fix, the link went to the address the requester entered in the form, not the one stored on the account. Any input that normalizes to the same value as a victim's address, such as a different letter case, or a lookalike address that an accent-insensitive database collation treats as equal, located the victim's account and delivered the victim's link to the attacker's mailbox.

The fix sends mail to the address returned by UserManager.GetEmailAsync for the account that was found, and stops if the account has no email address.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to one of:
  
  • NES for .NET Microsoft.AspNetCore.Identity.UI 6.0.47 or later
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• If the Identity UI pages were scaffolded into the application, change them to send to the stored address in the same way.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

Elemperor and Attila.Cs (zerodaybugs.com), as credited in Microsoft's advisory.