Library uses vulnerable version of Microsoft.AspNetCore.DataProtection

[DanielRose]

Microsoft.Identity.Web Library

Microsoft.Identity.Web

Microsoft.Identity.Web version

4.8.0

Web app

Sign-in users

Web API

Protected web APIs (validating tokens)

Token cache serialization

In-memory caches

Description

Microsoft.AspNetCore.DataProtection has a new CVE-2026-40372. It is fixed in version 10.0.7, however, this library uses 10.0.0.

Reproduction steps

1. Use the library as dependency in a project
2. Build
3. NU1903: Warning As Error: Package 'Microsoft.AspNetCore.DataProtection' 10.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-9mv3-2cwr-p262

Error message

NU1903: Warning As Error: Package 'Microsoft.AspNetCore.DataProtection' 10.0.0 has a known high severity vulnerability, GHSA-9mv3-2cwr-p262

Id Web logs

No response

Relevant code snippets

Build something using this as dependency

Regression

No response

Expected behavior

No error

[gitmln]

@bgavrilMS Could you please look into it? Deja-vu from #3777

[bgavrilMS]

Yes, we are on it. We are upgrading Azure.Identity first. And it looks like your fix introduces conflicts with Cryptography package.

[nicoBruhn]

When are you expecting to have a fix in place for this issue?