ASP.NET Core Data Protection 10.0.0–10.0.6: attackers can forge login cookies
Identifiers: CVE-2026-40372 · GHSA-9mv3-2cwr-p262 · CVSS 3.1 9.1 (scored by Microsoft)
What it is
A bug in the signature check of Microsoft.AspNetCore.DataProtection lets an attacker forge authentication cookies and other protected values, log in as any user (admins included) and decrypt some protected data. It affects apps that load the 10.0.0–10.0.6 NuGet package, mainly on Linux and macOS. Tokens the app issued to an attacker meanwhile (password reset links, API keys, refresh tokens) stay valid after the upgrade.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| NuGet | microsoft.aspnetcore.dataprotection | >= 10.0.0, <= 10.0.6 | 10.0.7 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up microsoft.aspnetcore.dataprotection in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade Microsoft.AspNetCore.DataProtection to 10.0.7 or later and redeploy. Then rotate the Data Protection key ring (IKeyManager.RevokeAllKeys; everyone signs in again) and revoke API keys, refresh tokens and password-reset links issued while you ran 10.0.0–10.0.6. Rotate any secret you stored inside Protect() output.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.