ASP.NET Core Token Forgery Leaves Privileged Sessions Behind
The break is not just privilege escalation. A regression in ASP.NET Core DataProtection let forged payloads pass authenticity checks, so patching to 10.0.7 stops new abuse but does not revoke tokens already issued during the vulnerable window.
Microsoft says CVE-2026-40372 affects Microsoft.AspNetCore.DataProtection 10.0.0–10.0.6, including .NET 10.0.6, and can let an unauthenticated attacker gain SYSTEM privileges on Linux, macOS, and other non-Windows systems. The flaw can also expose files and modify data, and Microsoft fixed it in ASP.NET Core 10.0.7.
The lasting risk is token persistence. If a forged login led the app to mint session refresh, API key, or password reset tokens, those tokens stay valid after upgrade unless the DataProtection key ring is rotated.