CVE-2026-123618

The ABP Framework versions prior to 10.7.1 are vulnerable to an authentication bypass (CWE-288). The root cause is that the system fails to enforce account state and two-factor authentication (2FA) checks when a password login is successful via a registered IExternalLoginProvider . An attacker wi...