Microsoft has released an out-of-band security update to fix a critical vulnerability introduced in last week’s ASP.NET Core release. The flaw, tracked as CVE-2026-40372 with a CVSS score of 9.1, affects the Data Protection Library and could let attackers forge authentication tokens.
Microsoft calls this a “regression,” where the April 14 Patch Tuesday update for .NET 10.0.6 accidentally broke secure HMAC validation in the ManagedAuthenticatedEncryptor. As a result, the library computed security hashes using the wrong data offset, making it possible to validate fake cookies and tokens that should have been rejected.
The impact is serious. Attackers could forge payloads to bypass Data Protection checks, decrypt protected data in auth cookies, anti-forgery tokens, TempData, and OIDC state. Worse, a successful attack could trick the app into issuing legitimate tokens like session refreshes or password reset links for the attacker.
Who Is Affected
The vulnerability hits Linux, macOS, and Windows systems where developers opted into managed cryptographic algorithms via the UseCustomCryptographicAlgorithms API. It covers NuGet package versions Microsoft.AspNetCore.DataProtection 10.0.0 through 10.0.6.
This comes just six months after a CVSS 9.9 flaw in ASP.NET’s Kestrel server. Microsoft compared the issue to the infamous 2010 MS10-070 vulnerability, which also involved cryptographic failures in ASP.NET.
Patch and Remediation Steps
The fix is in .NET 10.0.7, which should update automatically for server runtimes. But that is not enough for applications that embed the library, such as Docker containers. Developers must:
- Update to Microsoft.AspNetCore.DataProtection 10.0.7
- Rebuild and redeploy affected applications
- Expire all authentication cookies and tokens
- Rotate Data Protection keys to invalidate any forged payloads
Microsoft says there is no evidence of active exploitation, but recommends checking logs for unusual decryption errors or authentication failures.
Why This Matters
The flaw shows the risks of automatic updates when libraries are embedded in builds. For containerized apps, a simple package update is not sufficient — the whole application needs to be recompiled and redeployed to pick up the secure code.
Developers should audit dependencies (dotnet list package) and monitor for signs of compromise, even if no attack has been confirmed.
