CVE-2026-54781
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows bypassing SubjectConfirmation method URI and holder-of-key proof key validation in SAML tokens. An attacker can exploit this to downgrade holder-of-key or use custom confirmation method assertions to authenticate without proving authority over the assertion.
Risk Assessment
The organization faces risk of unauthorized access to WCF services, potentially leading to data confidentiality and integrity breaches and privilege escalation.
Recommendation
Immediately update CoreWCF to version 1.8.1 or 1.9.1, which contain the fix for this vulnerability.
Other vulnerabilities in CoreWCF
See all- CVE-2026-54782Critical
A vulnerability in CoreWCF (a port of WCF to .NET Core) prior to versions 1.8.1 and 1.9.1 causes SAML 1.1 and SAML 2.0 token validation to incorrectly resolve the issuer signing key or fail to require signed tokens when IdentityConfiguration is used with federated bindings. This allows an unauthenticated remote attacker to impersonate any principal the trusted STS could issue.
- CVE-2026-54784High
In CoreWCF version 1.9.0, SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used. This allows an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic.
- CVE-2026-54783High
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an attacker to replay a captured signed SOAP envelope to execute arbitrary service operations as the victim. The issue stems from missing verification that the ds:Signature covers the expected Security header target.
- CVE-2026-54780Low
Vulnerability in CoreWCF (a port of WCF for .NET Core) versions prior to 1.8.1 and 1.9.1. The WS-Security 1.0 receive pipeline validates the ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference DigestMethod, allowing a sender to use a rejected digest algorithm such as SHA-1 while the message is still accepted.
- CVE-2026-54779Medium
A vulnerability in the CoreWCF library causes SAML token replay protection to be inoperative. The DefaultTokenReplayCache.TryAdd method does not reject duplicate tokens even when DetectReplayedTokens is enabled, allowing a captured token to be reused.
- CVE-2026-54778Medium
A vulnerability in CoreWCF prior to versions 1.8.1 and 1.9.1 causes UnixDomainSocket POSIX peer identity resolution to use non-reentrant getpwuid and getgrgid calls. Under contention, this can attribute one connection's identity to another or crash the host process.
- CVE-2026-54776Medium
A vulnerability in CoreWCF allows bypassing PosixIdentity authentication in services hosted on Unix Domain Sockets. An attacker can send messages without the required stream upgrade, bypassing framing-layer identity checks.
- CVE-2026-54775Medium
A vulnerability in CoreWCF allows an attacker with Kafka produce permissions to cause a persistent denial of service (DoS) on an endpoint. When KafkaTransportPump receives a null-value tombstone record, the service stops processing new records from the Kafka topic.
- CVE-2026-54774High
A vulnerability in the CoreWCF library allows SAML signature verification to be skipped when a non-X.509 signing token is used. An attacker can reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification.
- CVE-2026-54773Medium
A vulnerability in CoreWCF before versions 1.8.1 and 1.9.1 allows an unauthenticated remote attacker to bypass WS-Security signature verification by placing a SOAP header before the wsse:Security header, causing the system to verify an attacker-supplied signature instead of the security header signature.
Original NVD description (English source)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion. This issue is fixed in versions 1.8.1 and 1.9.1.