Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Affected: NuGet: Microsoft.AspNetCore.Authentication.Negotiate

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft.AspNetCore.Authentication.Negotiate. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

ASP.NET Core Negotiate LDAP authentication can associate an authenticated identity with an unintended LDAP principal when the LDAP result is not verified against the Kerberos principal SID.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/458

## CVSS Details

- **Version:** 3.1 - **Severity:** High - **Score:** 7.5 - **Vector:** `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`

- **Weakness:** CWE-290 (Authentication Bypass by Spoofing) ## Affected Platforms

- **Platforms:** Windows, Linux, macOS when LDAP claim resolution is enabled - **Architectures:** All

## <a name="affected-packages"></a>Affected Packages

The vulnerability affects Microsoft .NET projects that use an affected package version listed below.

Package name | Affected version | Patched version ------------ | ---------------- | --------------- [Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate) | >= 10.0.0, <= 10.0.12 | 10.0.13 [Microsoft.AspNetCore.Authentication.Negotiate](https://www.nuget.org/packages/Microsoft.AspNetCore.Authentication.Negotiate) | >= 8.0.0, <= 8.0.31 | 8.0.32 [Microsoft.Asp…