ASP.NET Core includes an authentication flaw that allows an unauthenticated attacker to gain higher privileges across the network. The vulnerability is categorized as improper authentication and is listed as CWE‑640. Based on the description, it is inferred that the attacker could bypass normal security checks and execute actions under a privileged account, potentially leading to full administrative access.

Microsoft ASP.NET Core versions 8.0, 9.0, and 10.0, as well as Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10, are affected according to the CNA vendor list. The flaw exists in the core authentication framework used by these products.

With a CVSS score of 8.1 the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no known widespread exploitation at this time. Based on the description, it is inferred that the attack vector is remote, requiring network connectivity to the application and the ability to send crafted authentication requests. If exploited, it is inferred that an attacker could elevate privileges and potentially compromise the entire system.