Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

microsoft.aspnetcore.dataprotection

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.1NuGetPublished

    Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

    CVE-2026-40372 · GHSA-9mv3-2cwr-p262

    Affected
    • NuGet microsoft.aspnetcore.dataprotection >= 10.0.0, <= 10.0.6
    Fixed in
    10.0.7· Vendor fix available
    Issue
    Executive Summary: A bug in Microsoft.AspNetCore.DataProtection 10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to execute an Elevation of Privilege attack by forging authentication cookies, and also allows some protected payloads to be decrypted. If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue legitimately-signed tokens (session refresh, API key, password reset link, etc.) to themselves. Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated. This is comparable in capability to MS10-070, which exploited a similar padding-oracle condition in ASP.NET's legacy encryption infrastructure. Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/395 CVSS Details - Version: 3.1 - Severity: Important - Score: 9.1 - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness:…

    Recommended action: Upgrade to 10.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →