GitHub Security Advisory: GHSA-9mv3-2cwr-p262
Package: Microsoft.AspNetCore.DataProtection (NUGET)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 10.0.0, <= 10.0.6
Patched in: 10.0.7

Summary: Microsoft Security Advisory CVE-2026-40372 – ASP.NET Core Elevation of Privilege

Details:
## Executive Summary: 

A bug in `Microsoft.AspNetCore.DataProtection` 10.0.0-10.0.6 NuGet packages can give an attacker the opportunity to execute an Elevation of Privilege attack by forging authentication cookies, and also allows some protected payloads to be decrypted.

If an attacker used forged payloads to authenticate as a privileged user during the vulnerable window, they may have induced the application to issue **legitimately-signed** tokens (session refresh, API key, password reset link, etc.) to themselves. Those tokens remain valid after upgrading to 10.0.7 unless the DataProtection key ring is rotated.

This is comparable in capability to [MS10-070](https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2010/ms10-070), which exploited a similar padding-oracle condition in ASP.NET's legacy encryption infrastructure.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/395

## CVSS Details

- **Version:** 3.1
- **Severity:** Important
- **Score:** 9.1
- **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- **Weakness:** CWE-347: Improper Verification of Cryptographic Signature

## Affected Platforms

- **Platforms:** All
- **Architectures:** All

## <a name="affected-packages"></a>Affected Packages
The vulnerability affects some Microsoft .NET projects if they use any of affected package versions listed below

### <a name="ASP.NET Core 10"></a>ASP.NET Core 10
Package name | Affected version | Patched version
------------ | ---------------- | -------------------------
[Microsoft.AspNetCore.DataProtection](https://www.nuget.org/packages/Microsoft.AspNetCore.DataProtection)               | >=10.0.0, <=10.0.6 | 10.0.7

## Advisory FAQ

### <a name="how-affected"></a>How do I know if I am affected?
 
#### Primary affected configuration (10.0.6 on `net10.0`)
 
You are **affected** if ALL of the following are true:
 
- Your application referenced `Microsoft.AspNetCore.DataProtection` version 10.0.6 from NuGet (directly or transitively via, e.g., `Microsoft.AspNetCore.DataProtection.StackExchangeRedis`, `.EntityFrameworkCore`, `.AzureKeyVault`, `.AzureStorage`, `.Redis`), AND
The affected 10.0.6 NuGet binary was actually loaded at runtime. This happens when either the application does NOT target the Microsoft.NET.Sdk.Web NOR has a Microsoft.AspNetCore.App framework reference either directly or transitively UNLESS you opt out of PrunePackageReference which is enabled by default in .NET 10. 
- The application ran on Linux, macOS, or any non-Windows operating system.
 
#### Secondary affected configuration (10.0.x on `net462` / `netstandard2.0`)

You are also affected if:
 
- Your application or library referenced `Microsoft.AspNetCore.DataProtection` versions 10.0.0 through 10.0.6 from NuGet, AND
- The build consumed the `net462` or `netstandard2.0` target framework asset of that package. This occurs when your application does not target `net10.0` and consumes the package