Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

CoreWCF lets attacker impersonate trusted users

CVE-2026-54782 · published 3 months ago
Summary

Versions of CoreWCF before 1.8.1 and 1.9.1 may accept identity tokens without properly checking that they are signed by a trusted source. This means a remote attacker could pretend to be any user that the organization’s authentication service would normally issue. Upgrade to CoreWCF 1.8.1 or later to ensure signatures are correctly validated.

What to do
  • Update corewcf contributors corewcf.primitives to version 1.8.1.
  • Update corewcf contributors corewcf.primitives to version 1.9.1.
Affected software
Ecosystem VendorProductAffected versions
– corewcf corewcf >= 1.9.0, < 1.9.1
nuget corewcf contributors corewcf.primitives < 1.8.1
>= 1.9.0, < 1.9.1
Fix: upgrade to 1.8.1
Original advisory text
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-290Authentication Bypass by Spoofing
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published8 Jul 2026
Updated3 Nov 2026
First seen19 Jun 2026
Sources
GHSA-xjr9-gg9q-jx3v · GHSA
CVE-2026-54782 · NVD
CVE-2026-54782 · MITRE
CVE-2026-54782 · OSV
Track software like this
Free during beta