Authentication Bypass in ABP Framework by ABP

CVE-2026-123618

What is CVE-2026-123618?

The ABP Framework prior to version 10.7.1 is susceptible to an authentication bypass vulnerability. This flaw allows attackers to circumvent account state and two-factor authentication checks when valid password logins are executed via a registered external login provider. As a result, individuals with knowledge of the external directory password for disabled, locked, or 2FA-protected accounts can gain unauthorized access tokens from the /connect/token endpoint using the password grant method.

References