ASP.NET Core EUVD-2026-99694

Exploitation requires an application that uses the ASP.NET Core Identity packages (Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI) and exposes the password-reset or email-confirmation flows; the flaw is that these flows can send mail to the unvalidated address supplied in the request instead of the user's stored canonical address, enabling token interception and account takeover. Limiting factors: only deployments on affected runtime versions (ASP.NET Core 8.0 <8.0.32, 9.0 <9.0.21, 10.0 <10.0.13) that actually implement these Identity recovery flows are exposed, and the CVSS AC:H indicates the attacker must satisfy non-trivial conditions to steer the mail to an address they control, which is why CISA SSVC rates it Automatable=no.

This is a genuinely serious-but-not-emergency issue that should be prioritized for patching on a normal urgent cycle rather than treated as an active-exploitation fire drill. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with total CIA impact (C:H/I:H/A:H), which drives the 8.1 High score. However, multiple real-world signals temper this: CISA's SSVC decision shows Exploitation=none and Automatable=no, meaning no observed exploitation and that attackers cannot easily script it at scale; the vulnerability is NOT in CISA KEV; and no public exploit or POC is identified. The AC:H metric is consistent with the root cause - ASP.NET Core Identity password-reset/confirmation flows mailing the unvalidated request address - which requires the attacker to influence the reset request flow and win a non-trivial condition rather than fire a single deterministic request. No signals conflict in direction (all point to high-severity-but-not-yet-exploited); the main caveat is that 'Automatable:no' plus AC:H argues against mass scanning, suggesting any future exploitation would be targeted account-takeover rather than widespread. Net: real priority because impact is account takeover on a ubiquitous framework and a patch exists, but there is no evidence of in-the-wild use today.

An attacker targeting a web application built on ASP.NET Core Identity initiates a password-reset or email-confirmation request for a victim account and manipulates the flow so the reset/confirmation mail is delivered to an unvalidated, attacker-influenced address instead of the account's stored canonical address. If successful, the attacker obtains the reset token, sets a new password, and takes over the victim account, yielding elevation of privilege. No public exploit code is identified, and the CVSS AC:H indicates the attack depends on specific flow conditions rather than a trivial single request.