CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-311.
Summary
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CoreWCF | CoreWCF | 1.9.0 to before 1.9.1 | 1.9.1 | Patch available | CNA |
| — | CoreWCF.Primitives (NuGet) | 1.9.0 to before 1.9.1 | 1.9.1 | Patch available | GHSA-2288-8h3r-cqgg |
- CoreWCF VendorCoreWCF Affected 1.9.0 to before 1.9.1 Fixed in 1.9.1 Patch available CNA
- CoreWCF.Primitives (NuGet) Vendor— Affected 1.9.0 to before 1.9.1 Fixed in 1.9.1 Patch available GHSA-2288-8h3r-cqgg
Remediation
- Fix · CNA CoreWCF (CoreWCF) Fixed in 1.9.1
- Fix · GHSA-2288-8h3r-cqgg CoreWCF.Primitives (NuGet) Fixed in 1.9.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54784
- 2026-10-03 Alias added: GHSA-2288-8h3r-cqgg
References
Other 5
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-2288-8h3r-cqgg
- https://github.com/CoreWCF/CoreWCF/commit/2afae08b2fa5288428df89e8161116b816cf6b4b
- https://github.com/CoreWCF/CoreWCF/commit/f216aa6929d41dc99cee098b1e69c260ec4c41c7
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF
More CoreWCF vulnerabilities
- TI-2026-39588 CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation CVSS 3.1CRITICAL 10.0
- TI-2026-39578 CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake CVSS 3.1HIGH 7.5
- TI-2024-18811 CoreWCF NetFraming based services can leave connections open when they should be closed CVSS 3.1HIGH 7.5
- TI-2026-39589 Authentication bypass by capture-replay in CoreWCF CVSS 3.1HIGH 7.4
- TI-2026-39587 CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced CVSS 3.1HIGH 7.4
- TI-2026-39580 CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate CVSS 3.1HIGH 7.4
Sources
- CVE-2026-54784 · CVE Program
- CVE-2026-54784 · NVD
- FIRST EPSS
- GHSA-2288-8h3r-cqgg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences