CVE-2026-123618— ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

Quick assessment

Affected

abpframework abp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ABP Framework 10.7.1 之前的版本存在一个身份验证绕过漏洞：当通过已注册的进行密码登录并成功时，该漏洞会跳过账户状态检查和双因素认证（2FA）验证。攻击者若掌握外部目录中已停用、已锁定或受 2FA 保护的账户密码，即可通过端点的密码授权（password grant）获取有效的访问令牌。

CVSS 6.8 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

Source: CVE Program / CVE List V5

Vulnerability Description

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用候选路径或通道进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
abpframework	abp	0 ~ 10.7.1	-

II. Public POCs for CVE-2026-123618

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123618

请登录查看更多情报信息。

Other References for CVE-2026-123618 (7)

https://github.com/abpframework/abp product
https://github.com/abpframework/abp/commit/59b04c48dddbf79c58a65808400b4ed11f902ef1 patch
https://github.com/abpframework/abp/commit/b2fd3cf049c69e585fb621049fde55349865d132 patch
https://github.com/abpframework/abp/pull/26305 issue-tracking patch
https://github.com/abpframework/abp/releases/tag/10.7.1 release-notes
https://github.com/abpframework/abp/blob/10.7.0/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs#L52-L77 technical-description
https://www.vulncheck.com/advisories/abp-framework-before-10.7.1-authentication-bypass-via-external-login-provider third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123618

IV. Related Vulnerabilities

Same product: abp

CVE-2026-18759
An improper authentication and path traversal vulnerability

Same weakness: CWE-288