CVE-2026-70175

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker could compromise user accounts and achieve unauthorized privilege escalation in web applications utilizing ASP.NET Core Identity. The flaw specifically exposes deployments implementing built-in Identity confirmation and password-reset routines, which may dispatch sensitive reset tokens to attacker-controlled email addresses rather than the verified account address. Deployments that do not use ASP.NET Core Identity or do not expose standard password-reset and verification endpoints are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.