CVE-2026-70175: CWE-640: Weak Password Recovery Mechanism for Forgotten Password in Microsoft ASP.NET Core 10.0

This vulnerability (CWE-640) affects Microsoft.AspNetCore.Identity and Microsoft.AspNetCore.Identity.UI components used in ASP.NET Core Identity. The password reset and confirmation processes can send emails to an unvalidated request address rather than the user's stored canonical email address, potentially allowing attackers to intercept password reset communications. The vulnerability is present in multiple runtime packages across Windows, Linux, and macOS platforms. Microsoft has issued patches in versions 8.0.32, 9.0.21, 10.0.13, 17.14.42, and 18.10.4 to address this issue.

Successful exploitation could allow an attacker to receive password reset emails intended for the legitimate user, leading to account compromise and unauthorized access. The CVSS v3.1 score is 8.1 (High), reflecting the potential for confidentiality, integrity, and availability impacts without requiring privileges or user interaction.

An official fix is available from Microsoft. Users and developers should update affected Microsoft.AspNetCore.App.Runtime packages to the patched versions: 8.0.32, 9.0.21, 10.0.13, 17.14.42, or 18.10.4 depending on their version. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70175 for detailed update instructions. Applying these updates removes the vulnerability.