CVE-2026-70183: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Microsoft ASP.NET Core 10.0

This vulnerability arises from a race condition in the asynchronous authorization logic of Blazor's AuthorizeRouteView component within Microsoft.AspNetCore.Components.Authorization. Specifically, a stale authorization result may be applied after navigation or an authorization state change, allowing bypass of the current [Authorize] attribute decision. The issue affects multiple Microsoft.AspNetCore.App.Runtime packages across various platforms and architectures. Microsoft has acknowledged the vulnerability and provided official fixes in updated package versions. The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation of this race condition can allow an attacker to bypass authorization checks in Blazor applications, potentially granting unauthorized access to protected resources or functionality. The impact includes compromise of confidentiality, integrity, and availability of affected applications. The vulnerability affects all major operating systems supported by ASP.NET Core and multiple runtime package variants.

Microsoft has released official patches for this vulnerability. Users and developers should update affected Microsoft.AspNetCore.App.Runtime packages to the fixed versions: 8.0.32, 9.0.21, 10.0.13, 17.14.42, and 18.10.4 or later as applicable. Applying these updates removes the vulnerability. No additional mitigation steps are indicated by the vendor advisory.