CVE-2026-54782
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in CoreWCF (a port of WCF to .NET Core) prior to versions 1.8.1 and 1.9.1 causes SAML 1.1 and SAML 2.0 token validation to incorrectly resolve the issuer signing key or fail to require signed tokens when IdentityConfiguration is used with federated bindings. This allows an unauthenticated remote attacker to impersonate any principal the trusted STS could issue.
Risk Assessment
The organization faces a risk of complete compromise of federated authentication trust – an attacker can impersonate any user or service, potentially leading to unauthorized access to sensitive data and systems.
Recommendation
Immediately update CoreWCF to version 1.8.1 or 1.9.1. If an update is not possible, temporarily disable the use of IdentityConfiguration with federated bindings or apply additional SAML token validation mechanisms.
Original NVD description (English source)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.