SB2026111168 - Weak Password Recovery Mechanism for Forgotten Password in Microsoft.VisualStudio.Web.CodeGeneration.Design

Description

This security bulletin contains information about 1 vulnerability.

1) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: CVE-2026-118741)

CWE-ID: CWE-640 - Weak password recovery mechanism

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to take over a targeted account and elevate privileges.

The vulnerability exists due to a weak password recovery mechanism in ASP.NET Core when processing password reset requests. A remote attacker can submit a password reset request using a specially crafted email address that the application treats as equivalent to the victim's address to take over the targeted account.

Exploitation requires control of a distinct email address whose messages are delivered to a different mailbox than the victim's.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118741
• https://github.com/dotnet/aspnetcore/releases/tag/v10.0.15