CVE-2023-33170
dotnet: race condition in Core SignInManager PasswordSignInAsync method
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · July 11, 2023
Updated · November 22, 2025
Description
A vulnerability was found in dotNET applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords and bypass security restrictions. This flaw allows a remote attacker to bypass security features, causing an impact on confidentiality, integrity, and availability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')