---
id: "CVE-2026-118741"
page: "https://infrastack.ai/live/CVE-2026-118741"
kind: "vulnerability"
aliases: ["CVE-2026-118741"]
title: "ASP.NET Core Identity scaffolding and templates: weak password recovery lets an unauthenticated attacker gain higher privileges"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Microsoft.DotNet.Web.ProjectTemplates.8.0", "fixed": ["8.0.34"], "affected": ">= 8.0.32, < 8.0.34", "ecosystem": "nuget"}, {"name": "Microsoft.DotNet.Web.ProjectTemplates.9.0", "fixed": ["9.0.23"], "affected": ">= 9.0.21, < 9.0.23", "ecosystem": "nuget"}, {"name": "Microsoft.DotNet.Web.ProjectTemplates.10.0", "fixed": ["10.0.15"], "affected": ">= 10.0.13, < 10.0.15", "ecosystem": "nuget"}, {"name": "Microsoft.dotnet-scaffold", "fixed": ["20.3.0"], "affected": ">= 10.0.0, < 20.3.0", "ecosystem": "nuget"}, {"name": "Microsoft.dotnet-scaffold-aspnet", "fixed": ["9.0.13"], "affected": ">= 9.0.0, < 9.0.13", "ecosystem": "nuget"}]
ecosystems: []
tags: ["aspnet-core", "dotnet", "identity", "runtime", "scaffolding", "templates", "web-apps"]
not_affected_if: ["external-idp", "no-identity-scaffolding"]
published_at: "2026-11-10T19:19:50+00:00"
first_seen_at: "2026-11-10T19:24:55+00:00"
updated_at: "2026-11-10T23:00:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118741", "first_seen_at": "2026-11-10T19:24:55+00:00"}, {"source": "analyst", "url": "https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/", "first_seen_at": "2026-11-10T23:00:55+00:00", "cites": ["https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/", "https://app.opencve.io/cve/CVE-2026-118741"]}]
exploit_sources: []
---

# ASP.NET Core Identity scaffolding and templates: weak password recovery lets an unauthenticated attacker gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-118741 (this .md is for agents)

Microsoft's November 2026 servicing post says CVE-2026-118741 affects ASP.NET Core Identity scaffolding and templates, not the runtime. Code generated from the vulnerable templates stays vulnerable until it is corrected, rebuilt and redeployed. The CNA lists the weakness as CWE-640 (weak password recovery for a forgotten password). Not known to be exploited; no public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:Microsoft.DotNet.Web.ProjectTemplates.8.0 affected >= 8.0.32, < 8.0.34 fixed 8.0.34
- nuget:Microsoft.DotNet.Web.ProjectTemplates.9.0 affected >= 9.0.21, < 9.0.23 fixed 9.0.23
- nuget:Microsoft.DotNet.Web.ProjectTemplates.10.0 affected >= 10.0.13, < 10.0.15 fixed 10.0.15
- nuget:Microsoft.dotnet-scaffold affected >= 10.0.0, < 20.3.0 fixed 20.3.0
- nuget:Microsoft.dotnet-scaffold-aspnet affected >= 9.0.0, < 9.0.13 fixed 9.0.13

## How to check

Check whether the app was created with ASP.NET Core Identity scaffolding (Areas/Identity pages such as ForgotPassword, ResetPassword generated by dotnet-scaffold / aspnet-codegenerator) or from Identity project templates on .NET 8, 9 or 10. Look at the installed template/scaffold package versions (dotnet new list, dotnet tool list -g) against the fixed versions. The Microsoft advisory (MSRC CVE-2026-118741) holds the exact generated-code change; it did not render for me, so the specific file edit is unknown.

## Fix

Update the scaffolding/template packages or the .NET SDK that supplies the templates (.NET 8.0.34, 9.0.23, 10.0.15 servicing line), then correct the previously generated Identity source files, rebuild and redeploy. Updating the runtime alone does not repair generated code. Package fixed versions per CNA data (not yet read on Microsoft's own page): dotnet-scaffold 20.3.0, dotnet-scaffold-aspnet 9.0.13, Web.ProjectTemplates 8.0.34 / 9.0.23 / 10.0.15, VisualStudio.Web.CodeGeneration.Design and CodeGenerators.Mvc 10.0.3.

## Timeline

- 2026-11-10T19:24:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118741
- 2026-11-10T23:00:55+00:00 analyst https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/ — Primary: Microsoft .NET Nov 2026 servicing post (scaffolding/templates, regenerate code). Version ranges from CNA data via OpenCVE; MSRC page did not render. Only fix verified. Tier B, no exploitation seen.

## Documents

- [advisory] .NET and .NET Framework November 2026 servicing updates https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/
- [describes] OpenCVE CVE-2026-118741 (CNA affected package list) https://app.opencve.io/cve/CVE-2026-118741

## From the sources

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_