GitHub Advisoryadvisory · NuGet

GHSA-9jr3-rj99-8jq3 CoreWCF: SAML token replay protection is inoperative

MEDIUM Published 2026-06-19 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-54779
Ecosystem
NuGet
Packages
CoreWCF.Primitives
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-294, CWE-613
Reviewed
2026-06-19

Affected packages

• NuGet CoreWCF.Primitives: < 1.8.1 → fixed in 1.8.1 • NuGet CoreWCF.Primitives: >= 1.9.0, < 1.9.1 → fixed in 1.9.1

Description

Impact When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused. Patches Fixed in CoreWCF v1.8.1 and v1.9.1 Workarounds Provide your own implementation of `ITokenReplayCache` with the correct behavior.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2026-54779 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. vulnerability

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References