The Data Protection API secures critical elements such as auth cookies, session state, and OIDC state across ASP.NET Core applications. Exploitation could let attackers assume privileged identities ...

Patching is not enough: applications embedding the insecure library will need to be rebuilt, and affected tokens and cookies expired. Developers are advised to check their applications after Microsoft ...