{"id":"CVE-2026-123618","kind":"vulnerability","aliases":["CVE-2026-123618"],"related":[],"title":"ABP Framework: password login via external provider skips account and 2FA checks","description":"ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant.","summary":"ABP Framework versions before 10.7.1 skip account state and two-factor checks when a password login succeeds through a registered external login provider. An attacker who holds the external directory password for a deactivated, locked, or 2FA-protected account can get valid access tokens from the /connect/token password grant.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["abp-framework","asp.net-core","dotnet","identity-server","runtime"],"not_affected_if":["no-external-login-provider","password-grant-disabled"],"how_to_check":"- Check the ABP Framework version in the project's package references (for example `Volo.Abp.Core` or the `Volo.Abp` packages) and see whether it is below `10.7.1`.\n- Check whether an `IExternalLoginProvider` is registered and whether the `/connect/token` password grant is enabled.","fix":"- ABP Framework: upgrade to `10.7.1` or later.","status":"open","published_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","triaged_at":"2026-11-06T15:44:15+00:00","updated_at":"2026-11-06T15:44:15+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-06T15:44:15Z","model":"claude-haiku-5-5","output":{"fix":"- ABP Framework: upgrade to `10.7.1` or later.","reach":"internet","title":"ABP Framework: password login via external provider skips account and 2FA checks","impact":"high","summary":"ABP Framework versions before 10.7.1 skip account state and two-factor checks when a password login succeeds through a registered external login provider. An attacker who holds the external directory password for a deactivated, locked, or 2FA-protected account can get valid access tokens from the /connect/token password grant.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["abp-framework","dotnet","asp.net-core","identity-server"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker gets valid access tokens for locked or 2FA-protected accounts","analyst_note":"Confirm the fixed version and any configuration conditions from the Patch and Release notes links on github.com; the sources given do not state the exact fixed commit or which provider setups are affected.","how_to_check":"- Check the ABP Framework version in the project's package references (for example `Volo.Abp.Core` or the `Volo.Abp` packages) and see whether it is below `10.7.1`.\n- Check whether an `IExternalLoginProvider` is registered and whether the `/connect/token` password grant is enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["no-external-login-provider","password-grant-disabled"],"who_is_affected":"Applications built on ABP Framework before 10.7.1 that register an IExternalLoginProvider and expose the /connect/token password grant are exposed. Accounts that are deactivated, locked, or protected by 2FA are the ones at risk, because those checks are skipped. Applications without an external login provider, or without the password grant, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4301,"output_tokens":660,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123618':15A,18A '-2026':14A,17A '/connect/token':77B,127C '10.7.1':33B,83C '2fa':11A,67B,117C '2fa-protected':66B,116C 'abp':1A,20B,29B,80C 'abp-framework':19B 'access':73B,123C 'account':9A,35B,69B,91C,119C 'asp.net':22B 'attack':54B,106C 'authent':86C 'bypass':87C 'check':12A,41B,97C 'contain':84C 'core':23B 'cve':13A,16A 'deactiv':63B,113C 'directori':59B,110C 'dotnet':24B 'extern':6A,50B,58B,109C 'factor':40B,96C 'framework':2A,21B,30B,81C 'get':71B 'grant':79B,129C 'hold':56B,107C 'ident':26B 'identity-serv':25B 'iexternalloginprovid':105C 'lock':64B,114C 'login':4A,45B,51B,100C 'obtain':121C 'password':3A,44B,60B,78B,99C,111C,128C 'protect':68B,118C 'provid':7A,52B 'regist':49B,104C 'runtim':28B 'server':27B 'skip':8A,34B,90C 'state':36B,92C 'succeed':46B,101C 'token':74B,124C 'two':39B,95C 'two-factor':38B,94C 'valid':72B,122C 'version':31B 'via':5A 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Applications built on ABP Framework before 10.7.1 that register an IExternalLoginProvider and expose the /connect/token password grant are exposed. Accounts that are deactivated, locked, or protected by 2FA are the ones at risk, because those checks are skipped. Applications without an external login provider, or without the password grant, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["abpframework","aspnetcore","dotnet","high","identityserver","runtime"],"campaign_type":null,"search_a":"'-123618':15A,18A '-2026':14A,17A '2fa':11A 'abp':1A 'account':9A 'check':12A 'cve':13A,16A 'extern':6A 'framework':2A 'login':4A 'password':3A 'provid':7A 'skip':8A 'via':5A","search_b":"'/connect/token':77B '10.7.1':33B '2fa':67B '2fa-protected':66B 'abp':20B,29B 'abp-framework':19B 'access':73B 'account':35B,69B 'asp.net':22B 'attack':54B 'check':41B 'core':23B 'deactiv':63B 'directori':59B 'dotnet':24B 'extern':50B,58B 'factor':40B 'framework':21B,30B 'get':71B 'grant':79B 'hold':56B 'ident':26B 'identity-serv':25B 'lock':64B 'login':45B,51B 'password':44B,60B,78B 'protect':68B 'provid':52B 'regist':49B 'runtim':28B 'server':27B 'skip':34B 'state':36B 'succeed':46B 'token':74B 'two':39B 'two-factor':38B 'valid':72B 'version':31B","search_c":"'/connect/token':127C '10.7.1':83C '2fa':117C '2fa-protected':116C 'abp':80C 'access':123C 'account':91C,119C 'attack':106C 'authent':86C 'bypass':87C 'check':97C 'contain':84C 'deactiv':113C 'directori':110C 'extern':109C 'factor':96C 'framework':81C 'grant':129C 'hold':107C 'iexternalloginprovid':105C 'lock':114C 'login':100C 'obtain':121C 'password':99C,111C,128C 'protect':118C 'regist':104C 'skip':90C 'state':92C 'succeed':101C 'token':124C 'two':95C 'two-factor':94C 'valid':122C 'vulner':88C","first_public_at":"2026-11-06T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123618","severity":null,"published_at":"2026-11-06T15:17:19+00:00","modified_at":"2026-11-06T15:17:19+00:00","first_seen_at":"2026-11-06T15:42:44+00:00","fetched_at":"2026-11-06T15:42:44+00:00","note":null}],"documents":[{"id":87570,"url":"https://github.com/abpframework/abp/commit/59b04c48dddbf79c58a65808400b4ed11f902ef1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87571,"url":"https://github.com/abpframework/abp/commit/b2fd3cf049c69e585fb621049fde55349865d132","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":87572,"url":"https://github.com/abpframework/abp/releases/tag/10.7.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":87573,"url":"https://www.vulncheck.com/advisories/abp-framework-before-10.7.1-authentication-bypass-via-external-login-provider","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}