CVE-2026-54776

A vulnerability in CoreWCF (a port of WCF to .NET Core) prior to versions 1.8.1 and 1.9.1 causes SAML 1.1 and SAML 2.0 token validation to incorrectly resolve the issuer signing key or fail to require signed tokens when IdentityConfiguration is used with federated bindings. This allows an unauthenticated remote attacker to impersonate any principal the trusted STS could issue.

In CoreWCF version 1.9.0, SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used. This allows an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic.

A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an attacker to replay a captured signed SOAP envelope to execute arbitrary service operations as the victim. The issue stems from missing verification that the ds:Signature covers the expected Security header target.

A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows bypassing SubjectConfirmation method URI and holder-of-key proof key validation in SAML tokens. An attacker can exploit this to downgrade holder-of-key or use custom confirmation method assertions to authenticate without proving authority over the assertion.

Vulnerability in CoreWCF (a port of WCF for .NET Core) versions prior to 1.8.1 and 1.9.1. The WS-Security 1.0 receive pipeline validates the ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference DigestMethod, allowing a sender to use a rejected digest algorithm such as SHA-1 while the message is still accepted.

A vulnerability in the CoreWCF library causes SAML token replay protection to be inoperative. The DefaultTokenReplayCache.TryAdd method does not reject duplicate tokens even when DetectReplayedTokens is enabled, allowing a captured token to be reused.

A vulnerability in CoreWCF prior to versions 1.8.1 and 1.9.1 causes UnixDomainSocket POSIX peer identity resolution to use non-reentrant getpwuid and getgrgid calls. Under contention, this can attribute one connection's identity to another or crash the host process.

A vulnerability in CoreWCF allows an attacker with Kafka produce permissions to cause a persistent denial of service (DoS) on an endpoint. When KafkaTransportPump receives a null-value tombstone record, the service stops processing new records from the Kafka topic.

A vulnerability in the CoreWCF library allows SAML signature verification to be skipped when a non-X.509 signing token is used. An attacker can reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification.

A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an unauthenticated remote attacker to bypass WS-Security signature verification by placing a SOAP header before the wsse:Security header, causing the system to verify an attacker-supplied signature instead of the security header signature.