CVE-2026-112044: Improper Authentication in dotnet eShop

This vulnerability in dotnet eShop up to commit 913acea66708a59595351174cee9b29f37179d29 involves improper authentication due to a flaw in the AddApplicationServices function of the Catalog API component. The flaw allows remote attackers to bypass authentication mechanisms, potentially granting unauthorized access. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity impact. No patch or official vendor response has been documented yet.

Successful exploitation can lead to unauthorized access due to improper authentication, potentially allowing attackers to perform actions reserved for authenticated users. The vulnerability is remotely exploitable without requiring privileges or user interaction, increasing its risk profile. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded yet, monitor official dotnet project channels for updates and consider implementing additional access controls or network-level restrictions to mitigate exposure until a fix is available.