Threats tagged 'ghsa-67wp-ghc2-fw2g'

A critical elevation of privilege vulnerability (CVE-2026-114146) exists in Microsoft.AspNetCore.Http.Connections, part of ASP.NET Core. The flaw allows SignalR connections to not consistently bind to the identity negotiated at connection establishment, enabling injected messages to execute Hub invocations as the victim. This affects multiple platforms including Windows, Linux, and macOS across various runtime and standalone package versions. Microsoft has released patches for affected versions to address this issue.