Live › vulnerability › CVE-2026-70183
Go to dashboardASP.NET Core Blazor AuthorizeRouteView can apply a stale asynchronous authorization result after navigation or an authorization-state change, so the current [Authorize] decision is bypassed. An attacker with a low-privilege account may view content they should not be able to reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm |
| nuget |
| >= 8.0.0, <= 8.0.31 |
| 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | nuget | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
dotnet --info and check whether the installed Microsoft.AspNetCore.App runtime is 8.0.x up to 8.0.31, 9.0.x up to 9.0.20, or 10.0.x up to 10.0.12, or 11.0.0-preview.1 through 11.0.0-rc.1dotnet list package8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2, then rebuild and redeployEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Components.Authorization. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
A stale asynchronous authorization result in Blazor AuthorizeRouteView can be applied after navigation or an authorization-state change, bypassing the current [Authorize] decision.
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/460
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HThe vulnerability affects Microsoft .NET projects that use an affected package version listed below.
| Package name | Affected version | Patched version |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
This page as .md · .json · in your agent: get_signal("CVE-2026-70183")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.31 | 8.0.32 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0, <= 10.0.12 | 10.0.13 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.20 | 9.0.21 |
| Microsoft.AspNetCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, <= 11.0.0-rc.1 | 11.0.0-rc.2 |
| [Microsoft.AspNetCore.App.Runtime.osx |