CVE-2026-54773
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an unauthenticated remote attacker to bypass WS-Security signature verification by placing a SOAP header before the wsse:Security header, causing the system to verify an attacker-supplied signature instead of the security header signature.
Risk Assessment
An attacker could forge or modify SOAP messages, potentially leading to integrity and confidentiality breaches of data exchanged between services, as well as privilege escalation or unauthorized operations.
Recommendation
Upgrade CoreWCF to version 1.8.1 or 1.9.1 immediately, as these versions contain the fix for this vulnerability.
Other vulnerabilities in CoreWCF
See all- CVE-2026-54782Critical
A vulnerability in CoreWCF (a port of WCF to .NET Core) prior to versions 1.8.1 and 1.9.1 causes SAML 1.1 and SAML 2.0 token validation to incorrectly resolve the issuer signing key or fail to require signed tokens when IdentityConfiguration is used with federated bindings. This allows an unauthenticated remote attacker to impersonate any principal the trusted STS could issue.
- CVE-2026-54784High
In CoreWCF version 1.9.0, SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used. This allows an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic.
- CVE-2026-54783High
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an attacker to replay a captured signed SOAP envelope to execute arbitrary service operations as the victim. The issue stems from missing verification that the ds:Signature covers the expected Security header target.
- CVE-2026-54781High
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows bypassing SubjectConfirmation method URI and holder-of-key proof key validation in SAML tokens. An attacker can exploit this to downgrade holder-of-key or use custom confirmation method assertions to authenticate without proving authority over the assertion.
- CVE-2026-54780Low
Vulnerability in CoreWCF (a port of WCF for .NET Core) versions prior to 1.8.1 and 1.9.1. The WS-Security 1.0 receive pipeline validates the ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference DigestMethod, allowing a sender to use a rejected digest algorithm such as SHA-1 while the message is still accepted.
- CVE-2026-54779Medium
A vulnerability in the CoreWCF library causes SAML token replay protection to be inoperative. The DefaultTokenReplayCache.TryAdd method does not reject duplicate tokens even when DetectReplayedTokens is enabled, allowing a captured token to be reused.
- CVE-2026-54778Medium
A vulnerability in CoreWCF prior to versions 1.8.1 and 1.9.1 causes UnixDomainSocket POSIX peer identity resolution to use non-reentrant getpwuid and getgrgid calls. Under contention, this can attribute one connection's identity to another or crash the host process.
- CVE-2026-54776Medium
A vulnerability in CoreWCF allows bypassing PosixIdentity authentication in services hosted on Unix Domain Sockets. An attacker can send messages without the required stream upgrade, bypassing framing-layer identity checks.
- CVE-2026-54775Medium
A vulnerability in CoreWCF allows an attacker with Kafka produce permissions to cause a persistent denial of service (DoS) on an endpoint. When KafkaTransportPump receives a null-value tombstone record, the service stops processing new records from the Kafka topic.
- CVE-2026-54774High
A vulnerability in the CoreWCF library allows SAML signature verification to be skipped when a non-X.509 signing token is used. An attacker can reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification.
Original NVD description (English source)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security signature verification performs a document-wide ds:Signature lookup, allowing an unauthenticated remote attacker to place a SOAP header before wsse:Security and cause WSSecurityOneDotZeroReceiveSecurityHeader to verify an attacker-supplied signature instead of the security header signature. This issue is fixed in versions 1.8.1 and 1.9.1.