{"id":"CVE-2026-54782","aliases":["EUVD-2026-42473","GHSA-xjr9-gg9q-jx3v"],"status":"published","title":"CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00414,"percentile":0.36233,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290","CWE-347"],"published":"2026-06-19T20:47:11Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"NuGet","package":"CoreWCF.Primitives","fixed_in":["1.8.1","1.9.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"CoreWCF.Primitives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1"}]}]},{"source":"ghsa","ecosystem":"NuGet","package":"CoreWCF.Primitives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"CoreWCF.Primitives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1"}]}],"versions":["0.1.0","0.1.0-preview","0.1.0-preview-2","0.2.0","0.2.1","0.3.0","0.3.1","0.3.2","0.4.0","1.0.0","1.0.0-preview1","1.0.0-preview2","1.0.1","1.0.2","1.1.0","1.1.1","1.2.0","1.2.1","1.3.0","1.3.1","1.3.2","1.4.0","1.4.0-preview1","1.4.1","1.4.2","1.5.0","1.5.0-preview1","1.5.1","1.5.2","1.6.0","1.7.0","1.8.0"]},{"source":"osv","ecosystem":"NuGet","package":"CoreWCF.Primitives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.1"}]}],"versions":["1.9.0"]}],"products":[{"vendor":"corewcf","product":"corewcf"}],"references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-xjr9-gg9q-jx3v","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/0b8c8af851260e85e8402af53233d1b8f87dfb6f","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/0e63c2cca55763d8be6b226a234579280a09e7b6","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/e5cc9b6a4ecc102a50d782093bfc72e0790abe3d","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-xjr9-gg9q-jx3v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54782.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54782","tags":["advisory"]},{"url":"https://github.com/CoreWCF/CoreWCF","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54782","title":"CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T22:20:37.401Z","modified":"2026-07-10T03:55:37.656Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-42473","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T22:20:37Z","modified":"2026-07-10T03:55:37Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:20:03.742277Z"}],"ghsa":[{"id":"GHSA-xjr9-gg9q-jx3v","title":"CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation","description":"### Impact\nFull impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.\n\n#### Preconditions\nRelying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true).\nAttacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nNone","status":"published","published":"2026-06-19T20:47:11Z","modified":"2026-06-19T20:47:13Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T14:40:31.656952Z"}],"nvd":[{"id":"CVE-2026-54782","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T23:16:56.03Z","modified":"2026-07-10T05:16:37.52Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-54782","title":"CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.","status":"published","published":"2026-07-08T22:20:37.401Z","modified":"2026-10-28T02:31:01.624071654Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-xjr9-gg9q-jx3v","title":"CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation","description":"### Impact\nFull impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.\n\n#### Preconditions\nRelying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true).\nAttacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nNone","status":"published","published":"2026-06-19T20:47:11Z","modified":"2026-06-19T21:11:28.934937Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-290","CWE-347"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}