Threats tagged 'ghsa-xw2x-23jm-j582'

A high-severity elevation of privilege vulnerability exists in ASP.NET Core affecting the Blazor/SignalR `/_blazor/refresh` path. This flaw allows a cross-site request to bind a victim's authenticated principal to an attacker-owned circuit, potentially leading to unauthorized access. The issue affects multiple platforms including Windows, Linux, and macOS across all architectures. Versions from 11.0.0-preview.6.26359.118 up to and including 11.0.0-rc.3.26522.148 are vulnerable. A fixed version 11.0.0 has been released to address this vulnerability.