VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 14, 2023· Updated Oct 9, 2025

ASP.NET Core Security Feature Bypass Vulnerability

CVE-2023-36558

Description

ASP.NET Core Security Feature Bypass Vulnerability

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

An unauthenticated attacker can bypass validation on ASP.NET Core Blazor Server forms, potentially triggering unintended actions in affected .NET versions.

Vulnerability

Overview

CVE-2023-36558 is a security feature bypass vulnerability in ASP.NET Core that specifically affects Blazor Server applications. The root cause lies in the validation mechanism for Blazor server forms, which can be circumvented by an unauthenticated attacker [1][2]. This bypass allows the attacker to trigger unintended actions within the application, effectively undermining the security feature intended to prevent unauthorized form submissions.

Exploitation

Conditions

Exploitation requires no authentication and no special privileges. The attacker only needs network access to a vulnerable Blazor Server application. The vulnerability is present in ASP.NET Core Blazor 6.0 (up to 6.0.24), 7.0 (up to 7.0.13), and 8.0 RC2 [1][2]. Other ASP.NET Core application types that do not use Blazor are not affected.

Impact

A successful attack could lead to unintended actions being performed on the server, such as data modification or unauthorized operations, depending on the application's logic. The advisory does not specify remote code execution or data exfiltration, but the bypass could enable further exploitation if combined with other weaknesses [1][2].

Mitigation

Microsoft has released patches for all affected versions: .NET 6.0.25, .NET 7.0.14, and .NET 8.0.0 [1][2]. Developers should update their applications to these patched versions immediately. No workarounds are provided, and the only mitigation is applying the update.

References
  1. Microsoft Security Advisory CVE-2023-36558: .NET Security Feature Bypass Vulnerability
  2. Microsoft Security Advisory CVE-2023-36558: .NET Security Feature Bypass Vulnerability

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.AspNetCore.ComponentsNuGet
>= 8.0.0-rc.2.23480.2, < 8.0.08.0.0
Microsoft.AspNetCore.ComponentsNuGet
>= 7.0.0, < 7.0.147.0.14
Microsoft.AspNetCore.ComponentsNuGet
>= 6.0.0, < 6.0.256.0.25

Affected products

44

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.