Microsoft released .NET 10.0.7 (KB5091596) as an emergency OOB update on April 21, 2026. Per the .NET Blog, it patches CVE-2026-40372, a critical HMAC validation bypass in ASP.NET Core DataProtection that allows auth cookie forging.
Key takeaways
- CVE-2026-40372: critical HMAC bypass in ASP.NET Core DataProtection.
- Allows forging auth cookies, antiforgery tokens, TempData, OIDC state.
- Affects DataProtection package versions 10.0.0-10.0.6.
- Update NuGet package to 10.0.7, rebuild, redeploy.
Emergency .NET 10.0.7 Patches Critical Auth Cookie Forging Flaw
Microsoft released .NET 10.0.7 (KB5091596) on April 21, 2026, as an emergency out-of-band security update. Per the .NET Blog, the update patches CVE-2026-40372, a critical vulnerability in the Microsoft.AspNetCore.DataProtection NuGet package (versions 10.0.0-10.0.6).
Per BleepingComputer, the flaw allows unauthenticated attackers to forge authentication cookies, antiforgery tokens, TempData, and OIDC state by exploiting a broken HMAC validation in the managed authenticated encryptor. The bug was found after customers reported decryption failures following the .NET 10.0.6 Patch Tuesday release.
HMAC Bypass Enables Authentication Cookie Forging
Per the .NET Blog, the managed authenticated encryptor computes its HMAC tag over the wrong bytes and discards the computed hash in some cases. This breaks authenticity checks, allowing attackers to forge payloads that pass DataProtection validation and decrypt previously protected payloads including auth cookies and OIDC state.
ASP.NET Core 10.0 Applications Using DataProtection
All applications using Microsoft.AspNetCore.DataProtection versions 10.0.0 through 10.0.6. Update the NuGet package to 10.0.7, rebuild, and redeploy. No system restart required but applications must be restarted.
FAQ
What does KB5091596 fix?
CVE-2026-40372, a critical HMAC validation bypass in ASP.NET Core DataProtection (versions 10.0.0-10.0.6). Allows forging authentication cookies, antiforgery tokens, and OIDC state.
Am I affected?
Any application using Microsoft.AspNetCore.DataProtection NuGet package versions 10.0.0 through 10.0.6. Update to 10.0.7, rebuild, and redeploy.
What is the root cause?
The managed authenticated encryptor computed its HMAC tag over the wrong bytes and discarded the computed hash. This broke authenticity checks, allowing payload forging.
