CVE-2026-57578: DotVVM Auth Bypass Vulnerability

CVE-2026-57578 Overview

CVE-2026-57578 is a missing authorization vulnerability [CWE-862] in DotVVM, an open source Model-View-ViewModel (MVVM) framework for .NET web applications. The AuthorizeActionFilter class fails to enforce authorization checks because its explicit interface implementations return completed tasks instead of invoking the underlying authorization logic. Applications relying on this filter expose protected commands, view models, and presenters to unauthenticated network requests. The flaw affects DotVVM versions prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final.

Critical Impact
Remote unauthenticated attackers can invoke commands, view models, and presenters that were intended to be restricted, resulting in unauthorized access to protected application functionality and data.

Affected Products

DotVVM versions prior to 4.2.11
DotVVM versions prior to 4.3.15
DotVVM versions prior to 5.0.0-preview09-final

Discovery Timeline

2026-09-14 - CVE-2026-57578 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-57578

Vulnerability Analysis

The vulnerability resides in the AuthorizeActionFilter class within DotVVM's ASP.NET Core and OWIN hosting layers. DotVVM defines three action filter interfaces that participate in request handling: ICommandActionFilter, IViewModelActionFilter, and IPresenterActionFilter. Each interface exposes an executing hook that the framework awaits before allowing the corresponding operation to proceed.

In the vulnerable implementation, the explicit interface methods OnCommandExecutingAsync, OnViewModelCreatedAsync, and OnPresenterExecutingAsync return Task.CompletedTask instead of calling the protected virtual authorization methods on the base class. The framework therefore treats every request as authorized. Any protected command endpoint, view model, or presenter guarded solely by this filter accepts requests from anonymous or otherwise unauthorized clients.

Root Cause

The root cause is an incorrect explicit interface implementation. The base AuthorizeActionFilter defines protected virtual methods containing the authorization logic, but the explicit interface members that the framework actually invokes short-circuit to Task.CompletedTask. This is a classic missing function-level authorization defect [CWE-862].

Attack Vector

Exploitation requires no credentials, no user interaction, and no special bypass technique. An attacker sends a normal HTTP request to a DotVVM endpoint protected by AuthorizeActionFilter. Because the filter never evaluates identity or policy, the framework proceeds to execute the protected command, materialize the view model, or invoke the presenter.

text

// Patched code in src/Framework/Hosting.AspNetCore/Runtime/Filters/AuthorizeActionFilter.cs
// and src/Framework/Hosting.Owin/Runtime/Filters/AuthorizeActionFilter.cs

-        Task ICommandActionFilter.OnCommandExecutingAsync(IDotvvmRequestContext context, ActionInfo actionInfo) => Task.CompletedTask;
+        Task ICommandActionFilter.OnCommandExecutingAsync(IDotvvmRequestContext context, ActionInfo actionInfo) => OnCommandExecutingAsync(context, actionInfo);
         public Task OnCommandExecutedAsync(IDotvvmRequestContext context, ActionInfo actionInfo, Exception? exception) => Task.CompletedTask;
-        Task IViewModelActionFilter.OnViewModelCreatedAsync(IDotvvmRequestContext context) => Task.CompletedTask;
+        Task IViewModelActionFilter.OnViewModelCreatedAsync(IDotvvmRequestContext context) => OnViewModelCreatedAsync(context);
         public Task OnViewModelDeserializedAsync(IDotvvmRequestContext context) => Task.CompletedTask;
         public Task OnViewModelSerializingAsync(IDotvvmRequestContext context) => Task.CompletedTask;
-        Task IPresenterActionFilter.OnPresenterExecutingAsync(IDotvvmRequestContext context) => Task.CompletedTask;
+        Task IPresenterActionFilter.OnPresenterExecutingAsync(IDotvvmRequestContext context) => OnPresenterExecutingAsync(context);

Source: GitHub commit 7578cf3. The patch routes each explicit interface method to the corresponding protected authorization implementation.

Detection Methods for CVE-2026-57578

Indicators of Compromise

Successful HTTP responses to DotVVM postback endpoints (typically containing X-DotVVM-PostBack or X-PostBack headers) from clients without valid authentication cookies or tokens.
Application logs showing command execution, view model creation, or presenter invocation for identities that resolve to anonymous or unauthenticated principals.
Access to routes or presenters that are marked with AuthorizeActionFilter but return HTTP 200 for unauthenticated sessions.

Detection Strategies

Inventory the codebase for uses of AuthorizeActionFilter (as a global filter, [ActionFilter] attribute registration, or programmatic filter) and confirm the framework version in the .csproj or packages.lock.json file.
Perform authenticated and unauthenticated request comparison testing against each protected DotVVM endpoint to identify endpoints returning identical successful responses in both cases.
Review web server and application access logs for anomalous invocations of sensitive commands originating from sessions without authentication context.

Monitoring Recommendations

Ingest DotVVM application logs and IIS or Kestrel access logs into a centralized analytics platform and alert on protected route access without a corresponding authentication event.
Monitor for spikes in DotVVM postback requests from IP addresses that never completed an authentication flow.
Track deployment metadata to identify hosts still running DotVVM 4.2.x, 4.3.x, or 5.0.0-preview builds below the fixed versions.

How to Mitigate CVE-2026-57578

Immediate Actions Required

Upgrade DotVVM to 4.2.11, 4.3.15, or 5.0.0-preview09-final or later as documented in the GitHub Security Advisory GHSA-c8qj-jx8j-fg2w.
Audit all controllers, view models, and presenters that rely on AuthorizeActionFilter and validate that access controls behave as intended after the upgrade.
Restrict internet exposure of affected applications until patching is complete, particularly for endpoints handling sensitive data or state-changing commands.

Patch Information

The fix is delivered in the DotVVM v4.3.15 release and the v5.0.0-preview09 release. The relevant patch commits are 1635245, 4fc26a8, and 7578cf3, which route the explicit interface methods to the correct authorization logic in both the ASP.NET Core and OWIN hosting layers.

Workarounds

Replace usages of AuthorizeActionFilter with AuthorizeAttribute, which correctly implements the same interfaces and enforces authorization, as noted in the vendor advisory.
Enforce authentication at an upstream layer (reverse proxy, API gateway, or middleware) so that unauthenticated requests never reach DotVVM postback handlers on vulnerable versions.

bash

# Update the DotVVM package reference to a patched version
dotnet add package DotVVM.AspNetCore --version 4.3.15
dotnet add package DotVVM.Owin --version 4.3.15

# Verify the resolved version
dotnet list package | grep -i DotVVM