CoreWCF WS-Security Signature Verification Bypass

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with one captured signed SOAP envelope to replay arbitrary service operations as the victim principal. This issue is fixed in versions 1.8.1 and 1.9.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54783

Affected Vendors & Products

Vendor	Product	Version / Range
corewcf	corewcf	to 1.8.1 (exc)
corewcf	corewcf	to 1.9.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability exists in CoreWCF, a port of the Windows Communication Foundation to .NET Core. Before versions 1.8.1 and 1.9.1, the WS-Security implementation in CoreWCF did not properly verify that the selected digital signature (ds:Signature) covered the expected Security header target. This flaw allows an attacker who has captured a signed SOAP message to replay arbitrary service operations as if they were the legitimate user.

Impact Analysis

The vulnerability can allow an attacker to replay signed SOAP messages, effectively impersonating a legitimate user and performing unauthorized operations on the affected service. This can lead to unauthorized access, data manipulation, or other malicious actions performed under the victim's identity.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade CoreWCF to version 1.8.1 or 1.9.1, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70