SAML Signature Bypass in CoreWCF

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token, allowing an attacker to reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This issue is fixed in versions 1.8.1 and 1.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54774

Affected Vendors & Products

Vendor	Product	Version / Range
corewcf	corewcf	to 1.8.1 (inc)
corewcf	corewcf	to 1.9.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation service to .NET Core. Before versions 1.8.1 and 1.9.1, the SamlSerializer component did not perform the final verification of the SignatureValue when validating SAML tokens if the signing token was not an X.509 certificate. This means that an attacker could exploit this flaw by referencing a non-X.509 SecurityToken key identifier, effectively bypassing the assertion signature verification process.

Impact Analysis

Because the signature verification can be bypassed, an attacker could potentially forge or manipulate SAML tokens without detection. This could allow unauthorized access to services or data protected by CoreWCF, leading to a compromise of confidentiality and integrity. The CVSS score of 7.4 indicates a high severity with network attack vector, no privileges required, and no user interaction needed.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue with SamlSerializer skipping final SignatureValue verification has been fixed.

Hi! I’m here to help you understand CVE-2026-54774. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70