CVE-2026-54779

CoreWCF: SAML token replay protection is inoperative

5.9 MediumFix available

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token replay protection is inoperative because DefaultTokenReplayCache.TryAdd does not reject duplicate tokens when DetectReplayedTokens is enabled, allowing a captured token to be reused. This issue is fixed in versions 1.8.1 and 1.9.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: None

Exploit likelihood

0.43%Up 0.2 points since Jul 9, 2026

What each source reports

CVE List Score used 5.9

CoreWCF: SAML token replay protection is inoperative

Record: CVE-2026-54779
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-294, CWE-613
Updated: 2026-11-02

EUVDEUVD-2026-42463 5.9

Record: EUVD-2026-42463
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9jr3-rj99-8jq3 5.9

CoreWCF: SAML token replay protection is inoperative

Impact

When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

Provide your own implementation of ITokenReplayCache with the correct behavior.

Record: GHSA-9jr3-rj99-8jq3
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-294, CWE-613
Updated: 2026-11-02

NVD 5.9

Record: CVE-2026-54779
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-294, CWE-613
Updated: 2026-11-02

OSV 5.9

CoreWCF: SAML token replay protection is inoperative

Record: CVE-2026-54779
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-294, CWE-613
Updated: 2026-11-02

OSVGHSA-9jr3-rj99-8jq3 5.9

CoreWCF: SAML token replay protection is inoperative

Impact

When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

Provide your own implementation of ITokenReplayCache with the correct behavior.

Record: GHSA-9jr3-rj99-8jq3
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness: CWE-294, CWE-613
Updated: 2026-11-02

Affected products

corewcf

Affected packages

Affected packages
Package	Affected	Fixed
`CoreWCF.Primitives` NuGet	before 1.8.1	1.8.1
`CoreWCF.Primitives` NuGet	1.9.0 up to 1.9.1	1.9.1
`CoreWCF.Primitives` NuGet	before 1.8.1, plus listed versions 0.1.00.1.0-preview0.1.0-preview-20.2.00.2.1 Show 27 moreShow less 0.3.00.3.10.3.20.4.01.0.01.0.0-preview11.0.0-preview21.0.11.0.21.1.01.1.11.2.01.2.11.3.01.3.11.3.21.4.01.4.0-preview11.4.11.4.21.5.01.5.0-preview11.5.11.5.21.6.01.7.01.8.0	1.8.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-54779 is a medium vulnerability (CVSS 5.9) in Corewcf, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in CoreWCF.Primitives 1.8.1.

References

Show 4 moreShow less