Read the docs
TI-2018-05916 Aliases CVE-2018-8171GHSA-vhvh-528q-ff3p

Improper authentication in Microsoft ASP.NET

Priority MEDIUM 46CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET, ASP.NET Core 1.1, ASP.NET Core 1.0, ASP.NET Core 2.0, ASP.NET MVC 5.2.

Why it matters now

EPSS 0.10774 95th percentileScored 2026-11-07
Fix Fixed Microsoft.AspNetCore.Identity (NuGet): 1.0.6, 1.1.6, 2.0.4 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftASP.NETWeb Pages 3.2.3 on Microsoft Visual Studio 2013 Update 5; Web Pages 3.2.3 on Microsoft Visual Studio 2015 Update 3—No fix listedCNA
MicrosoftASP.NET Core1.0; 1.1; 2.0—No fix listedCNA
MicrosoftASP.NET MVC 5.2Microsoft Visual Studio 2013 Update 5; Microsoft Visual Studio 2015 Update 3—No fix listedCNA
—Microsoft.AspNetCore.Identity (NuGet)1.0.0 to before 1.0.61.0.6Patch availableGHSA-vhvh-528q-ff3p
—Microsoft.AspNetCore.Identity (NuGet)1.1.0 to before 1.1.61.1.6Patch availableGHSA-vhvh-528q-ff3p
—Microsoft.AspNetCore.Identity (NuGet)2.0.0 to before 2.0.42.0.4Patch availableGHSA-vhvh-528q-ff3p
—Microsoft.AspNetCore.Identity (NuGet)2.1.0 to before 2.1.22.1.2Patch availableGHSA-vhvh-528q-ff3p
  • ASP.NET VendorMicrosoft Affected Web Pages 3.2.3 on Microsoft Visual Studio 2013 Update 5; Web Pages 3.2.3 on Microsoft Visual Studio 2015 Update 3 Fixed in — No fix listed CNA
  • ASP.NET Core VendorMicrosoft Affected 1.0; 1.1; 2.0 Fixed in — No fix listed CNA
  • ASP.NET MVC 5.2 VendorMicrosoft Affected Microsoft Visual Studio 2013 Update 5; Microsoft Visual Studio 2015 Update 3 Fixed in — No fix listed CNA
  • Microsoft.AspNetCore.Identity (NuGet) Vendor— Affected 1.0.0 to before 1.0.6 Fixed in 1.0.6 Patch available GHSA-vhvh-528q-ff3p
  • Microsoft.AspNetCore.Identity (NuGet) Vendor— Affected 1.1.0 to before 1.1.6 Fixed in 1.1.6 Patch available GHSA-vhvh-528q-ff3p
  • Microsoft.AspNetCore.Identity (NuGet) Vendor— Affected 2.0.0 to before 2.0.4 Fixed in 2.0.4 Patch available GHSA-vhvh-528q-ff3p
  • Microsoft.AspNetCore.Identity (NuGet) Vendor— Affected 2.1.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-vhvh-528q-ff3p

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:*1.0VulnerableMicrosoft
cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:*1.1VulnerableMicrosoft
cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:*2.0VulnerableMicrosoft
cpe:2.3:a:microsoft:asp.net_model_view_controller:5.2:*:*:*:*:*:*:*5.2VulnerableMicrosoft
cpe:2.3:a:microsoft:asp.net_webpages:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableMicrosoft
  • cpe:2.3:a:microsoft:asp.net_core:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:asp.net_core:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:asp.net_core:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:asp.net_model_view_controller:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:asp.net_webpages:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Microsoft

Remediation

  • Fix · GHSA-vhvh-528q-ff3p Microsoft.AspNetCore.Identity (NuGet) Fixed in 1.0.6 Advisory →
  • Fix · GHSA-vhvh-528q-ff3p Microsoft.AspNetCore.Identity (NuGet) Fixed in 1.1.6 Advisory →
  • Fix · GHSA-vhvh-528q-ff3p Microsoft.AspNetCore.Identity (NuGet) Fixed in 2.0.4 Advisory →
  • Fix · GHSA-vhvh-528q-ff3p Microsoft.AspNetCore.Identity (NuGet) Fixed in 2.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-8171
  2. 2026-10-03 Alias added: GHSA-vhvh-528q-ff3p

References

Patch 1

Advisory 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2025-34970 ASP.NET Security Feature Bypass Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2024-14164 .NET Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-18092 ASP.NET Core Denial of Service Vulnerability CVSS 3.1HIGH 8.2
  • TI-2023-18392 ASP.NET Core Security Feature Bypass Vulnerability CVSS 3.1MEDIUM 6.2
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences