ABP Framework versions before 10.7.1 allow an authentication bypass that skips account state and two‑factor checks when a password login succeeds through a registered external provider. An attacker who has obtained the external directory password for a deactivated, locked, or 2FA‑protected account can use the /connect/token password grant to receive a valid access token, effectively gaining unauthorized authenticated access to the system. The vulnerability does not provide privilege escalation beyond what the compromised account can normally perform; it merely removes the intended barriers to entry. The weakness is a form of authentication bypass (CWE-288).

The affected product is the ABP Framework. Any deployment of ABP Framework with a version earlier than 10.7.1 that employs the Volo.Abp.OpenIddict.AspNetCore bearer token handlers is vulnerable. The vulnerability is linked to the TokenController.Password code path used for external login providers in those versions.

The CVSS score of 7.6 indicates a moderate to high severity of the bypass. EPSS information is not available, so the likelihood of exploitation cannot be quantified from current data. The vulnerability is not listed in the CISA KEV catalog. Attackers need access to a valid external directory credential for a deactivated or 2FA‑protected account, so the attack vector is credential compromise or social engineering rather than an automated exploit.