SAML Token Replay Vulnerability in CoreWCF

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captured token to be reused. This issue is fixed in versions 1.8.1 and 1.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54779

Affected Vendors & Products

Vendor	Product	Version / Range
corewcf	corewcf	to 1.8.1 (inc)
corewcf	corewcf	to 1.9.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation to .NET Core. Before versions 1.8.1 and 1.9.1, the SAML token replay protection mechanism was not working properly because the DefaultTokenReplayCache.TryAdd method did not reject duplicate tokens even when DetectReplayedTokens was enabled. This flaw allows an attacker to reuse a captured SAML token, effectively bypassing replay protection.

Impact Analysis

The vulnerability allows an attacker to reuse a previously captured SAML token, which can lead to unauthorized actions or impersonation within systems relying on CoreWCF for authentication. Although it does not affect confidentiality or availability, it impacts the integrity of the authentication process, potentially allowing attackers to perform actions as legitimate users.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1 where the issue with SAML token replay protection has been fixed.

Hi! I’m here to help you understand CVE-2026-54779. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70