I am setting SameSite in Startup.Auth.cs like this:

CookiePath = "/; SameSite=Lax",

But for Login action, on redirection; the Set-Cookie value is being automatically set by the framework and not by code. The issue is that the Set-Cookie that is a response header has .AspNet.ApplicationCookie as its value. This is a very big vulnerability as the cookie is being exposed as part of response.

This is the state that I am getting for redirected Login action with HTTPResponseCode 302:

Set-Cookie is having .AspNet.ApplicationCookie

How to avoid/disable this vulnerability?

As described in the question, the scenario is to be avoided.