CVE-2026-123618

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts...

CVE-2026-123618

The ABP Framework versions prior to 10.7.1 are vulnerable to an authentication bypass (CWE-288). The root cause is that the system fails to enforce account state and two-factor authentication (2FA) checks when a password login is successful via a registered IExternalLoginProvider . An attacker wi...

EUVD-2026-118294

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts...

CVE-2026-123618 ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts...

CVE-2026-123618: abpframework abp: ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor…

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts...