CVE-2026-54782

Received Received - Intake

SAML Token Validation Flaw in CoreWCF

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54782

Affected Vendors & Products

Vendor	Product	Version / Range
corewcf	corewcf	to 1.8.1 (inc)
corewcf	corewcf	to 1.9.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation to .NET Core. Before versions 1.8.1 and 1.9.1, the SAML 1.1 and SAML 2.0 token validation did not properly resolve the issuer signing key or enforce that tokens were signed when using IdentityConfiguration with federated bindings.

Because of this, an unauthenticated remote attacker could impersonate any principal that the trusted Security Token Service (STS) could issue, effectively bypassing authentication controls.

This issue was fixed in CoreWCF versions 1.8.1 and 1.9.1.

Impact Analysis

The vulnerability allows an unauthenticated remote attacker to impersonate any user or principal that the trusted Security Token Service (STS) could issue tokens for.

This means an attacker could gain unauthorized access to systems or services that rely on CoreWCF for authentication, potentially leading to data breaches, unauthorized actions, or privilege escalation.

The CVSS score of 10.0 indicates a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1 or later, where the issue with SAML token validation is fixed.

Hi! I’m here to help you understand CVE-2026-54782. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70