CVE-2026-70179

Name of the Vulnerable Software and Affected Versions Microsoft.AspNetCore.Authentication.Negotiate versions 10.0.0 through 10.0.12 Microsoft.AspNetCore.Authentication.Negotiate versions 8.0.0 through 8.0.31 Microsoft.AspNetCore.Authentication.Negotiate versions 9.0.0 through 9.0.20

Description Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network. This occurs when ASP.NET Core Negotiate LDAP authentication associates an authenticated identity with an unintended LDAP principal because the LDAP result is not verified against the Kerberos principal SID.

Recommendations Update Microsoft.AspNetCore.Authentication.Negotiate versions 10.0.0 through 10.0.12 to version 10.0.13. Update Microsoft.AspNetCore.Authentication.Negotiate versions 8.0.0 through 8.0.31 to version 8.0.32. Update Microsoft.AspNetCore.Authentication.Negotiate versions 9.0.0 through 9.0.20 to version 9.0.21. Recompile and redeploy any self-contained applications targeting the affected versions.