CVE-2026-118741

Name of the Vulnerable Software and Affected Versions ASP.NET Core versions 8.0 through 8.0.33 ASP.NET Core versions 9.0 through 9.0.22 ASP.NET Core versions 10.0 through 10.0.14

Description Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. This issue specifically affects Identity pages generated by the scaffolder or templates, such as 'ForgotPassword' and 'ResetPassword'.

Recommendations Update to ASP.NET Core version 8.0.34 or later, rebuild, and redeploy the application. Update to ASP.NET Core version 9.0.23 or later, rebuild, and redeploy the application. Update to ASP.NET Core version 10.0.15 or later, rebuild, and redeploy the application. Update dotnet-scaffold to version 20.3.0 or later.