External risk intelligence

DotVVM Authorization Filter Bypass Leading to Unauthorized Access.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-57578

DotVVM is a framework designed for building web applications. As this vulnerability exists within a component used to manage authorization for web-based actions, view models, and presenters, it directly impacts the exposed web surface of any application built using the framework. Such applications are commonly deployed as internet-facing web services.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the DotVVM framework could allow unauthorized access to protected application features. This issue arises from an authorization filter that, under certain conditions, fails to perform the necessary checks, potentially exposing sensitive commands, view models, or presenters to external requests. The main concern is confirming relevance and exposure.

Authorization checks fail in DotVVM.
Unprotected commands and data may be exposed.
Confirm if your web applications are affected.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component through network access without needing special bypass techniques. The vulnerability lies in the `AuthorizeActionFilter` within the DotVVM framework, which fails to perform authorization checks. This exposure could allow unauthorized access to protected parts of a web application, potentially leading to data exposure or unauthorized actions.

Network access is required.
Unauthorized requests trigger the vulnerability.
Protected resources may be exposed.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, applications using the vulnerable DotVVM framework could expose protected commands, view models, or presenters to unauthorized requests. This occurs because the `AuthorizeActionFilter` fails to perform necessary authorization checks, effectively allowing unauthenticated access to these components.

Protected application components.
Unauthorized access to exposed features.
Potential for unintended system actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and platform teams are likely responsible for addressing this authorization bypass vulnerability in DotVVM. The first step is to identify all instances of the affected DotVVM framework within your environment, determine their business criticality and external reachability, and then confirm the accountable owner for each identified deployment to plan remediation.

Identify affected DotVVM deployments.
Verify external reachability and business impact.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is DotVVM?

DotVVM is an open-source framework used by developers to build web applications using the Model-View-ViewModel (MVVM) pattern. It allows developers to create interactive, data-bound web interfaces in .NET. It simplifies the connection between the user interface and the server-side logic by handling the synchronization of data models automatically, which is why vulnerabilities in its core components can impact the security of the entire application.

What does CVE-2026-57578 mean for my security?

This vulnerability is classified as CWE-862, which is a Missing Authorization flaw. In the context of CVE-2026-57578, a specific security component called AuthorizeActionFilter is broken. Instead of verifying user permissions as intended, it silently skips those checks. This means that functionality developers thought was locked behind authentication is actually open to anyone who sends a request to the application.

Do I need special access to trigger this bug?

No. The vulnerability does not require any clever bypass techniques or deep system knowledge to trigger. Because the filter itself fails to execute the necessary checks, any request directed at a protected command, view model, or presenter will simply be processed as if it were authorized. If the resource is reachable, the lack of authorization logic is sufficient to allow unauthorized access.

Is my application at risk?

If your application uses an affected version of DotVVM, it is likely at risk. Halo Surface Signal identifies this as a critical concern because DotVVM is designed for web applications, which are frequently deployed as internet-facing services. Since the authorization failure affects the web surface directly, any publicly accessible part of your application that relies on this filter for protection is exposed.

How do I start fixing this?

First, inventory your software to identify every instance where DotVVM is used within your environment. Verify whether your applications use the AuthorizeActionFilter for sensitive features. If you are running an outdated version, update to 4.2.11, 4.3.15, or 5.0.0-preview09-final. As a verified workaround, developers can switch to the AuthorizeAttribute, which correctly implements the necessary interfaces and provides the security checks that the current filter fails to perform.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.