Leonardo Souza

A cross-site request forgery (CSRF) flaw in Blazor and SignalR allows an unauthorized attacker to elevate privileges over a network. By sending a cross-site request to the '/ blazor/refresh' endpoint, an attacker can bind a user's identity to an attacker's circuit, enabling them to act as a signed-in user.

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. This issue specifically affects Identity pages generated by the scaffolder or templates, such as 'ForgotPassword' and 'ResetPassword'.

When configured to use an OpenID Connect (OIDC) Identity Provider (IdP) for authentication, the software uses the email claim as the username. Because some IdPs allow users to modify the email claim without verification or fail to set the `email verified` claim, an attacker can impersonate another user by changing their email address within the IdP, leading to account takeover.