Description

ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-factor checks when password login succeeds through a registered IExternalLoginProvider. Attackers holding the external directory password for deactivated, locked, or 2FA-protected accounts can obtain valid access tokens from the /connect/token password grant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-06T15:17:19.187Z",
  "pubdate": "2026-11-06T15:17:19.187Z",
  "executiveSummary": "The ABP Framework prior to version 10.7.1 is affected by an authentication bypass vulnerability involving the IExternalLoginProvider integration.\nThis flaw allows unauthorized access to user accounts by circumventing critical security checks, specifically account state validation (e.g., locked or deactivated status) and multi-factor authentication (2FA) requirements.\nThe vulnerability resides within the password grant flow handling for external providers when integrated with the /connect/token endpoint.\nSuccessful exploitation enables an attacker who possesses valid external directory credentials to authenticate as a compromised user regardless of the internal account security policy or existing 2FA restrictions.\nThe impact is significant, as it leads to full account takeover, facilitating unauthorized access to sensitive application data and functionality.\nRemediation requires upgrading the ABP Framework to version 10.7.1 or later to ensure proper validation logic is enforced during external password grant authentication.",
  "technicalDetails": "The vulnerability originates from a logical flaw in the authentication pipeline of the ABP Framework's identity integration, specifically within the password grant flow handled by IdentityServer/OpenIddict.\nWhen a user authenticates via a registered IExternalLoginProvider, the framework fails to perform necessary post-authentication checks during the token issuance process at the /connect/token endpoint.\nStandard identity workflows require the system to verify the local account status—checking if the account is disabled, locked out, or requires secondary authentication (2FA) before returning an access token.\nThe root cause is the bypass of the application's security state validation when the underlying password login succeeds via an external provider implementation.\nAn attacker possessing the external directory credentials for a target account can exploit this by initiating a password grant request against the application's token endpoint.\nSince the framework incorrectly trusts the external authentication success as sufficient proof of authorization, it skips the evaluation of local account flags and 2FA requirements.\nConsequently, the system issues a valid access token to the attacker, providing them with authenticated access to the user's account without triggering the expected security blocks.\nThis affects all users configured to use external login providers, particularly those whose accounts are in a restricted state or are protected by multi-factor authentication.\nThe exploitation does not require administrative privileges; it only requires the attacker to possess the credentials corresponding to the external provider linked to the target account.\nPost-exploitation, the attacker assumes the identity of the victim within the ABP Framework environment, allowing for data extraction, unauthorized transactions, or further privilege escalation depending on the victim's application-level permissions."
}