CVE-2026-70183

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An authorization bypass vulnerability (CVE-2026-70183) has been identified in ASP.NET Core Blazor. When an authorization check is still running and the user navigates or their authentication state changes, the older, stale result can be applied after the newer one, so Blazor may render content that the current [Authorize] policy denies.

Per CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), the weakness is a product containing a code sequence that can run concurrently with other code, where the sequence needs temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

This issue affects ASP.NET Core 6.0 Blazor Server and Blazor WebAssembly applications that use AuthorizeView, AuthorizeRouteView, or [Authorize] on routable components, on Windows, Linux, and macOS. Exploitation requires an authenticated user and precise timing. Microsoft's advisory lists ASP.NET Core 8.0, 9.0, 10.0 and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there.

Blazor Server applications get the fix from the ASP.NET Core shared framework. Blazor WebAssembly applications carry Microsoft.AspNetCore.Components.Authorization as a package and must update it to 6.0.47 and redeploy. Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Details

Module Info

• Product: Any NES for .NET 6 Blazor application at version 6.0.46 or earlier that uses Blazor's authorization components.
• Affected packages: ASP.NET Core shared framework (Microsoft.AspNetCore.App, in-box for Blazor Server); Microsoft.AspNetCore.Components.Authorization (package referenced by Blazor WebAssembly apps)
• Affected versions:
  
  • ASP.NET Core >= 6.0.0 <= 6.0.46
  • Microsoft.AspNetCore.Components.Authorization >= 6.0.0 <= 6.0.46
• Package manager: NuGet, Windows Installer, Docker
• GitHub repository: https://github.com/dotnet/aspnetcore
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in: NES for .NET 6.0.47

Vulnerability Info

This High-severity vulnerability is found in AuthorizeViewCore, the base of Blazor's AuthorizeView and AuthorizeRouteView components, in Microsoft.AspNetCore.Components.Authorization.

Each time its parameters change, for example on navigation to a page with a different policy or when the authentication state is updated, AuthorizeViewCore awaits the current authentication state and runs the authorization check, then stores the principal and the result for rendering. These checks are asynchronous and can overlap. Before the fix, whichever check finished last won, even if it had been started for an earlier set of parameters. A slow "authorized" result for a weaker policy or an earlier principal could therefore overwrite the newer decision, rendering protected content or pairing the current decision with the wrong user.

The fix gives each parameter set its own cancellation token and cancels the previous one. A check that completes after it has been superseded is discarded, and the principal and decision are now stored together.

This vulnerability has been present since at least ASP.NET Core 6.0 and likely earlier.

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected ASP.NET Core deployments to one of:
  
  • NES for .NET 6.0.47 or later (Blazor WebAssembly apps also need Microsoft.AspNetCore.Components.Authorization 6.0.47)
  • .NET / ASP.NET Core 8.0.32 or later
  • .NET / ASP.NET Core 9.0.21 or later
  • .NET / ASP.NET Core 10.0.13 or later
• Enforce authorization on the server for any data or action a protected component exposes, rather than relying on what the client renders.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 or later.

Credits

l8BL with ENKI WhiteHat, as credited in Microsoft's advisory.