PT-2026-143415

CVE-2026-109481

Published

2026-11-10

Updated

2026-11-11

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions prior to 11.0.0

Description A cross-site request forgery (CSRF) flaw in Blazor and SignalR allows an unauthorized attacker to elevate privileges over a network. By sending a cross-site request to the '/ blazor/refresh' endpoint, an attacker can bind a user's identity to an attacker's circuit, enabling them to act as a signed-in user.

Recommendations Update to version 11.0.0 and rebuild self-contained apps to ensure the embedded runtime is replaced.

Exploitability

Fix

Impacts

Researchers