GitHub Advisoryadvisory · NuGet

GHSA-xjr9-gg9q-jx3v CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

CRITICAL Published 2026-06-19 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-54782
Ecosystem
NuGet
Packages
CoreWCF.Primitives
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-290, CWE-347
Reviewed
2026-06-19

Affected packages

• NuGet CoreWCF.Primitives: < 1.8.1 → fixed in 1.8.1 • NuGet CoreWCF.Primitives: >= 1.9.0, < 1.9.1 → fixed in 1.9.1

Description

Impact Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0. Preconditions Relying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true). Attacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable). Patches Fixed in CoreWCF v1.8.1 and v1.9.1 Workarounds None

Related

Alias · CVE (1)

  • CVE-2026-54782 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. vulnerability

Weakness · CWE (2)

  • CWE-290 Authentication Bypass by Spoofing weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References