CoreWCF: SAML token replay protection is inoperative
Priority LOW 27CWE-294Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-294.
Summary
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captured token to be reused. This issue is fixed in versions 1.8.1 and 1.9.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed CoreWCF (CoreWCF): 1.9.1, 1.8.1CoreWCF.Primitives (NuGet): 1.8.1, 1.9.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CoreWCF | CoreWCF | 1.9.0 to before 1.9.1; before 1.8.1 | 1.9.1, 1.8.1 | Patch available | CNA |
| — | CoreWCF.Primitives (NuGet) | before 1.8.1 | 1.8.1 | Patch available | GHSA-9jr3-rj99-8jq3 |
| — | CoreWCF.Primitives (NuGet) | 1.9.0 to before 1.9.1 | 1.9.1 | Patch available | GHSA-9jr3-rj99-8jq3 |
- CoreWCF VendorCoreWCF Affected 1.9.0 to before 1.9.1; before 1.8.1 Fixed in 1.9.1, 1.8.1 Patch available CNA
- CoreWCF.Primitives (NuGet) Vendor— Affected before 1.8.1 Fixed in 1.8.1 Patch available GHSA-9jr3-rj99-8jq3
- CoreWCF.Primitives (NuGet) Vendor— Affected 1.9.0 to before 1.9.1 Fixed in 1.9.1 Patch available GHSA-9jr3-rj99-8jq3
Remediation
- Fix · CNA CoreWCF (CoreWCF) Fixed in 1.9.1, 1.8.1
- Fix · GHSA-9jr3-rj99-8jq3 CoreWCF.Primitives (NuGet) Fixed in 1.8.1 Advisory →
- Fix · GHSA-9jr3-rj99-8jq3 CoreWCF.Primitives (NuGet) Fixed in 1.9.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54779
- 2026-10-03 Alias added: GHSA-9jr3-rj99-8jq3
References
Other 7
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-9jr3-rj99-8jq3
- https://github.com/CoreWCF/CoreWCF/commit/3800c4e2bb4c6fde00ddacefdc2221ef33d55621
- https://github.com/CoreWCF/CoreWCF/commit/7b0b5231cf21b4b5c1fc3caac9981f8bee43823f
- https://github.com/CoreWCF/CoreWCF/commit/84f8cff5a786b5aaa73448cb379d366a7df98238
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF
More CoreWCF vulnerabilities
- TI-2026-39588 CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation CVSS 3.1CRITICAL 10.0
- TI-2026-39578 CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake CVSS 3.1HIGH 7.5
- TI-2024-18811 CoreWCF NetFraming based services can leave connections open when they should be closed CVSS 3.1HIGH 7.5
- TI-2026-39590 CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality CVSS 3.1HIGH 7.4
- TI-2026-39589 Authentication bypass by capture-replay in CoreWCF CVSS 3.1HIGH 7.4
- TI-2026-39587 CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced CVSS 3.1HIGH 7.4
Sources
- CVE-2026-54779 · CVE Program
- CVE-2026-54779 · NVD
- FIRST EPSS
- GHSA-9jr3-rj99-8jq3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences