ASP.NET Core EUVD-2026-99698

Exploitation requires a Blazor application that uses the Microsoft.AspNetCore.Components.Authorization AuthorizeRouteView component to enforce [Authorize] on routes; apps not using Blazor component-level authorization are unaffected. The attacker must already be an authenticated user (PR:L) and must induce a navigation or authorization-state change at the right moment so a stale asynchronous authorization result is applied to the new authorization decision. Limiting factors: High attack complexity (AC:H) because the outcome depends on winning a non-deterministic timing race, prior valid authentication is required (not unauthenticated), and only the specific Blazor authorization-routing feature is in scope rather than all ASP.NET Core deployments. No end-user interaction beyond the attacker's own actions is needed (UI:N).

Signals are mixed and point to a credible-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) describes a network-reachable flaw requiring an already-authenticated low-privileged user (PR:L) and carries High attack complexity (AC:H), which is consistent with a timing-dependent race condition (CWE-362) that cannot be triggered deterministically. CISA's SSVC framework reinforces low urgency: Exploitation=none (no observed active exploitation), Automatable=no (cannot be reliably mass-exploited), though Technical Impact=total, matching the C:H/I:H/A:H impact. Public POC/exploit code exists (a GitHub gist), but this is distinct from active exploitation - there is no CISA KEV listing and SSVC explicitly records no observed exploitation. Net assessment: this is a legitimate 7.5/High authorization-bypass bug in a very widely used framework, but the AC:H race condition and PR:L precondition make opportunistic mass exploitation unlikely; prioritize patching for internet-facing Blazor applications handling sensitive authorization boundaries, but it is not a drop-everything emergency. Note a minor framing tension worth verifying: the input Tags label this 'Information Disclosure,' while the authoritative GHSA advisory describes it as a Security Feature Bypass / authorization bypass and the CVE description frames it as privilege elevation - treat it primarily as an authorization bypass with full confidentiality/integrity/availability impact.

An authenticated low-privileged user of a Blazor server/WebAssembly application that relies on AuthorizeRouteView rapidly navigates or forces an authorization-state change so that a stale asynchronous authorization result from a prior state is applied to the new route, bypassing the current [Authorize] decision and rendering a protected component they should not reach. Because this is a race condition (AC:H), the attacker may need many timed attempts to win the race. Public exploit code exists in a referenced GitHub gist, lowering the research barrier, though no active in-the-wild exploitation has been reported.