Bug 2569853 (CVE-2026-118741)

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. How could an attacker exploit this vulnerability? An unauthenticated attacker could exploit this vulnerability by submitting a password reset request using a specially crafted email address that is treated as equivalent to another account. Successful exploitation could allow the attacker to take over the targeted account. No user interaction is required. According to the CVSS metric, the attack complexity is high (AC:H). What does this mean for this vulnerability? Successful exploitation requires the attacker to control a distinct email address that an affected application's account lookup treats as equivalent to the victim's address, while messages are delivered to a different mailbox.