CVE-2026-109481: Cross-Site Request Forgery Leading to Elevation of Privilege in ASP.NET Core

CVE-2026-109481 is an Elevation of Privilege (EoP) vulnerability in Microsoft ASP.NET Core affecting .NET 11.0 preview releases and Microsoft Visual Studio 2026 version 18.12. The flaw resides in the server-side interactive component architecture, specifically within the Blazor Server and SignalR circuit management subsystem. This subsystem is responsible for maintaining stateful UI rendering and user session boundaries across persistent connections.

In a Blazor Server deployment, client-side events are transmitted over a persistent SignalR connection to a server-side construct known as a circuit. Each circuit encapsulates the component hierarchy, application state, and the authenticated security context (ClaimsPrincipal) of the connected user. To support dynamic authentication state changes—such as cookie sliding expiration or token refreshes—ASP.NET Core exposes an auxiliary HTTP endpoint at /_blazor/refresh.

Classified under CWE-352 (Cross-Site Request Forgery), the vulnerability occurs because the /_blazor/refresh endpoint accepts state-modifying HTTP requests without validating request origin or antiforgery tokens. An unauthenticated remote attacker can exploit this weakness by tricking an authenticated user into visiting a malicious web page that submits a cross-site request containing the attacker's circuit identifier.

When the vulnerable endpoint processes this cross-site request, it extracts the authenticated identity from the victim's ambient session cookies and binds that ClaimsPrincipal to the attacker-controlled circuit. Consequently, the attacker gains the ability to execute server-side component actions and access sensitive data under the victim's security context, achieving privilege elevation within the application.

The root cause of CVE-2026-109481 is the omission of origin verification and CSRF protection mechanisms on the /_blazor/refresh endpoint within the ASP.NET Core Blazor Server middleware pipeline. While standard SignalR connection negotiation and component rendering lifecycles implement baseline security checks, the auxiliary refresh endpoint processed incoming requests relying solely on ambient HTTP credentials.

During normal operation, when an application's HTTP authentication state updates, the client invokes /_blazor/refresh to synchronize the active HTTP HttpContext.User with the in-memory SignalR circuit. The server reads the target circuit identifier from the incoming HTTP request and updates that circuit's internal authentication state using the ClaimsPrincipal derived from the request's authentication cookies.

The endpoint failed to enforce three critical security controls required for state-synchronization routes:

• It did not require or validate an ASP.NET Core antiforgery token via the IAntiforgery service.
• It did not verify that the Origin or Referer headers matched the application's host authority, nor did it inspect Fetch Metadata headers (Sec-Fetch-Site).
• It did not verify whether the caller initiating the refresh already owned or was previously associated with the target circuit connection prior to rebinding the identity.

Because browsers automatically attach ambient session cookies to cross-site requests unless restricted by strict SameSite policies, a third-party origin can trigger this endpoint. When the server processes the forged request, it fails to distinguish between a legitimate synchronization event initiated by the client application and a cross-origin request forged by an external party.

While Microsoft did not publish a standalone commit diff isolated from the .NET 11.0.0 general availability release tag, the mechanics of the vulnerability and the necessary defensive logic can be analyzed through the ASP.NET Core middleware pipeline. In vulnerable pre-release versions (11.0.0-preview.1), the endpoint handler for /_blazor/refresh accepted incoming requests and immediately proceeded to circuit state hydration without passing through an antiforgery filter.

To remediate this flaw at the request pipeline level, the endpoint must enforce both cryptographic token validation and browser-enforced Fetch Metadata checks. The following implementation demonstrates the defensive middleware controls required to secure the /_blazor/refresh route against cross-site principal rebinding:

// Remediation pattern: Enforcing Antiforgery and Fetch Metadata on Blazor auxiliary endpoints
app.UseAntiforgery();
 
app.Use(async (context, next) =>
{
    // Intercept requests targeting the internal Blazor circuit refresh endpoint
    if (context.Request.Path.StartsWithSegments("/_blazor/refresh"))
    {
        // 1. Validate Fetch Metadata to block cross-site requests at the protocol boundary
        if (context.Request.Headers.TryGetValue("Sec-Fetch-Site", out var site) &&
            site != "same-origin" && site != "same-site")
        {
            context.Response.StatusCode = StatusCodes.Status403Forbidden;
            return;
        }
 
        // 2. Enforce explicit Antiforgery token validation
        var antiforgery = context.RequestServices.GetRequiredService<IAntiforgery>();
        try
        {
            await antiforgery.ValidateRequestAsync(context);
        }
        catch (AntiforgeryValidationException)
        {
            context.Response.StatusCode = StatusCodes.Status400BadRequest;
            return;
        }
    }
    
    await next();
});

In addition to endpoint-specific checks, session cookie configuration plays a decisive role in determining whether ambient credentials are transmitted during cross-origin requests. If an application configures authentication cookies with SameSite=None to support cross-domain embedding or federated authentication flows, the browser sends the session cookie with every cross-origin request.

// Hardening session cookie configuration to restrict cross-origin transmission
builder.Services.ConfigureApplicationCookie(options =>
{
    // Restrict cookie transmission to first-party contexts and top-level navigation
    options.Cookie.SameSite = SameSiteMode.Lax;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.HttpOnly = true;
});

Assessing fix completeness requires evaluating both token validation and circuit ownership verification. Enforcing SameSiteMode.Lax prevents cookies from being sent on cross-site fetch or XMLHttpRequest calls, but top-level navigation requests (GET) still transmit Lax cookies. Therefore, complete remediation requires the server to reject GET requests for state synchronization, validate Sec-Fetch-Site headers, and verify cryptographic antiforgery tokens bound to the specific user identity.

Exploiting CVE-2026-109481 requires coordination between an attacker-controlled connection and an authenticated victim's browser session. This requirement accounts for the High Attack Complexity (AC:H) and Required User Interaction (UI:R) metrics in the CVSS v3.1 scoring. The attacker does not need valid credentials on the target application (PR:N), provided the application allows unauthenticated users to initialize a baseline Blazor circuit (such as on a public landing page or login view).

The exploitation sequence proceeds across six distinct phases:

1. Circuit Pre-allocation: The attacker establishes a connection to the target ASP.NET Core application and negotiates an active, unauthenticated Blazor Server circuit over SignalR. The attacker extracts and records the negotiated circuit identifier (circuitId) from the handshake response.
2. Trap Deployment: The attacker deploys a web page on an external domain under their control. This page contains client-side script or an auto-submitting HTML form configured to issue an HTTP request to https://<target-app>/_blazor/refresh, embedding the attacker's pre-allocated circuitId as a parameter.
3. Victim Delivery: The attacker delivers the link to the malicious site to a user who holds an active, authenticated session on the target ASP.NET Core application.
4. Cross-Site Request Execution: When the victim navigates to the attacker's page, the victim's browser executes the forged request to /_blazor/refresh. If the target application's authentication cookies are configured to allow transmission in that request context, the browser includes the victim's session cookie.
5. Principal Rebinding: The vulnerable ASP.NET Core server receives the request, authenticates the session cookie to construct the victim's ClaimsPrincipal, and updates the in-memory circuit matching the provided circuitId with this authenticated identity.
6. Privilege Abuse: Because the attacker maintains the active WebSocket/SignalR connection bound to that circuitId, all subsequent component interactions and server-side method invocations executed by the attacker are evaluated under the victim's elevated security context.

> [!NOTE] > As of the publication of this report, the CVSS Exploit Code Maturity metric is classified as Unproven (E:U). No public proof-of-concept scripts or weaponized exploit modules have been indexed in public repositories.

Successful exploitation of CVE-2026-109481 grants an unauthenticated attacker full access to the application capabilities and data authorized for the compromised victim account. Because Blazor Server circuits execute directly on the server and maintain direct access to backend services, database contexts, and internal APIs via dependency injection, hijacking a circuit's security principal compromises Confidentiality, Integrity, and Availability within the application's scope (S:U).

In terms of Confidentiality (C:H), the attacker can render privileged UI components and invoke component lifecycle methods that retrieve sensitive user data, administrative records, or configuration secrets exposed to the victim's role. For Integrity (I:H), the attacker can trigger state-changing server-side event handlers, modify database records, or create new administrative accounts if an administrator's session is targeted.

For Availability (A:H), the attacker can manipulate shared application state, terminate active administrative workflows, or exhaust circuit resources allocated to privileged operations. The CVSS v3.1 base score of 7.5 reflects the balance between the severe post-exploitation impact and the operational constraints of synchronizing an active SignalR circuit with a timed user interaction.

From a threat intelligence perspective, CVE-2026-109481 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and there is no evidence of active exploitation in the wild. The vulnerability specifically impacts pre-release deployments running .NET 11.0 (11.0.0-preview.1) across Linux, macOS, and Windows platforms, as well as developer environments running Microsoft Visual Studio 2026 version 18.12 prior to 18.12.0.

The primary remediation for CVE-2026-109481 is to upgrade affected .NET runtimes, SDKs, and development environments to the patched general availability releases provided by Microsoft. Administrators and developers utilizing pre-release builds of .NET 11.0 must upgrade to .NET 11.0.0 or later. Users of Microsoft Visual Studio 2026 on Windows must update their installations to version 18.12.0 or higher.

For environments where immediate runtime patching cannot be completed, defense-in-depth mitigations can be applied within the application code or at the reverse proxy layer:

• Custom Request Filtering Middleware: Register custom middleware prior to endpoint routing that intercepts requests to /_blazor/refresh and enforces Sec-Fetch-Site header validation. Reject any request where the Sec-Fetch-Site header is present and set to cross-site or none.
• Antiforgery Enforcement: Ensure app.UseAntiforgery() is explicitly registered in the HTTP request pipeline between UseAuthentication()/UseAuthorization() and endpoint mapping declarations (MapRazorComponents).
• Cookie Hardening: Audit all authentication cookie schemes (AddCookie, OpenID Connect session handlers) to ensure SameSite is set to SameSiteMode.Lax or SameSiteMode.Strict, and CookieSecurePolicy is set to Always.

At the perimeter or Web Application Firewall (WAF) layer, security engineers can deploy inspection rules targeting the /_blazor/refresh URI path. Blocking requests to this endpoint when the Sec-Fetch-Site header equals cross-site or when the Origin header does not match the Host header prevents cross-origin exploitation attempts before they reach the Kestrel web server.