CVE-2026-123618: ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

Published Nov 6, 2026

Updated

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant.

Event History

Nov 6, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using ABP Framework versions before 10.7.1 are affected when they have a registered IExternalLoginProvider and allow password-grant token requests through /connect/token. Accounts backed by the external provider are exposed if they are deactivated, locked, or protected by two-factor authentication.

What does an attacker need to exploit the bypass?

The attacker needs the external directory password for a targeted account. They can then use the /connect/token password grant to obtain a valid access token despite the account’s disabled, lockout, or two-factor state.

What can be done while upgrading is pending?

Restrict or disable the /connect/token password grant for accounts authenticated through registered external login providers where possible. This reduces the exposed authentication path until ABP Framework can be updated to 10.7.1 or later.

How can teams identify potentially affected accounts?

Review whether IExternalLoginProvider is registered and inspect password-grant requests to /connect/token. Treat successful token issuance for deactivated, locked, or 2FA-protected externally authenticated accounts as an indicator of exposure.

CVE-2026-123618: ABP Framework before 10.7.1 Authentication Bypass via External Login Provider

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

What can be done while upgrading is pending?

How can teams identify potentially affected accounts?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit the bypass?

What can be done while upgrading is pending?

How can teams identify potentially affected accounts?