SAML Signature Bypass in CoreWCF

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation service to .NET Core. Before versions 1.8.1 and 1.9.1, the SamlSerializer component did not perform the final verification of the SignatureValue when validating SAML tokens if the signing token was not an X.509 certificate. This means that an attacker could exploit this flaw by referencing a non-X.509 SecurityToken key identifier, effectively bypassing the assertion signature verification process.

Useful 0 Not Useful 0

Impact Analysis

Because the signature verification can be bypassed, an attacker could potentially forge or manipulate SAML tokens without detection. This could allow unauthorized access to services or data protected by CoreWCF, leading to a compromise of confidentiality and integrity. The CVSS score of 7.4 indicates a high severity with network attack vector, no privileges required, and no user interaction needed.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue with SamlSerializer skipping final SignatureValue verification has been fixed.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-54774 allows an attacker to bypass signature verification of SAML assertions when non-X.509 signing tokens are used, potentially enabling unauthorized access or manipulation of authentication tokens.

This vulnerability impacts the confidentiality and integrity of authentication tokens, which are critical for secure identity and access management.

Failure to properly verify SAML token signatures could lead to unauthorized access to sensitive data, thereby risking non-compliance with data protection regulations such as GDPR and HIPAA that require strong authentication and data integrity controls.

By allowing forged assertions to be accepted, the vulnerability undermines trust in authentication mechanisms, which may violate regulatory requirements for secure access controls and data protection.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper signature verification of SAML tokens signed with non-X.509 tokens in CoreWCF services. Detection would require inspecting SAML assertions processed by the service to identify if signature verification is bypassed when non-X.509 tokens are used.

Since the issue is in the CoreWCF SamlSerializer component's handling of SAML tokens, detection on the network or system level would involve capturing and analyzing SAML token exchanges to check if tokens signed with non-X.509 keys are accepted without proper signature validation.

There are no specific commands provided in the available resources for detecting this vulnerability directly on a system or network.

A practical approach might include enabling detailed logging in CoreWCF services to monitor SAML token validation failures or anomalies, or using tools to capture and inspect SAML tokens in transit for suspicious signature values.

Useful 0 Not Useful 0