CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CoreWCF | CoreWCF | 1.9.0 to before 1.9.1; before 1.8.1 | 1.9.1, 1.8.1 | Patch available | CNA |
| — | CoreWCF.Primitives (NuGet) | before 1.8.1 | 1.8.1 | Patch available | GHSA-xjr9-gg9q-jx3v |
| — | CoreWCF.Primitives (NuGet) | 1.9.0 to before 1.9.1 | 1.9.1 | Patch available | GHSA-xjr9-gg9q-jx3v |
- CoreWCF VendorCoreWCF Affected 1.9.0 to before 1.9.1; before 1.8.1 Fixed in 1.9.1, 1.8.1 Patch available CNA
- CoreWCF.Primitives (NuGet) Vendor— Affected before 1.8.1 Fixed in 1.8.1 Patch available GHSA-xjr9-gg9q-jx3v
- CoreWCF.Primitives (NuGet) Vendor— Affected 1.9.0 to before 1.9.1 Fixed in 1.9.1 Patch available GHSA-xjr9-gg9q-jx3v
Remediation
- Fix · CNA CoreWCF (CoreWCF) Fixed in 1.9.1, 1.8.1
- Fix · GHSA-xjr9-gg9q-jx3v CoreWCF.Primitives (NuGet) Fixed in 1.8.1 Advisory →
- Fix · GHSA-xjr9-gg9q-jx3v CoreWCF.Primitives (NuGet) Fixed in 1.9.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54782
- 2026-10-03 Alias added: GHSA-xjr9-gg9q-jx3v
References
Other 7
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-xjr9-gg9q-jx3v
- https://github.com/CoreWCF/CoreWCF/commit/0b8c8af851260e85e8402af53233d1b8f87dfb6f
- https://github.com/CoreWCF/CoreWCF/commit/0e63c2cca55763d8be6b226a234579280a09e7b6
- https://github.com/CoreWCF/CoreWCF/commit/e5cc9b6a4ecc102a50d782093bfc72e0790abe3d
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF
More CoreWCF vulnerabilities
- TI-2026-39578 CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake CVSS 3.1HIGH 7.5
- TI-2024-18811 CoreWCF NetFraming based services can leave connections open when they should be closed CVSS 3.1HIGH 7.5
- TI-2026-39590 CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality CVSS 3.1HIGH 7.4
- TI-2026-39589 Authentication bypass by capture-replay in CoreWCF CVSS 3.1HIGH 7.4
- TI-2026-39587 CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced CVSS 3.1HIGH 7.4
- TI-2026-39580 CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate CVSS 3.1HIGH 7.4
Sources
- CVE-2026-54782 · CVE Program
- CVE-2026-54782 · NVD
- FIRST EPSS
- GHSA-xjr9-gg9q-jx3v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences