{"id":"CVE-2026-54784","aliases":["EUVD-2026-42471","GHSA-2288-8h3r-cqgg"],"status":"published","title":"CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00272,"percentile":0.19799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-311","CWE-523"],"published":"2026-06-19T20:47:17Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"NuGet","package":"CoreWCF.Primitives","fixed_in":["1.9.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"CoreWCF.Primitives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"CoreWCF.Primitives","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.1"}]}],"versions":["1.9.0"]}],"products":[{"vendor":"corewcf","product":"corewcf"}],"references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-2288-8h3r-cqgg","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/2afae08b2fa5288428df89e8161116b816cf6b4b","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/commit/f216aa6929d41dc99cee098b1e69c260ec4c41c7","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-2288-8h3r-cqgg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54784.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54784","tags":["advisory"]},{"url":"https://github.com/CoreWCF/CoreWCF","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54784","title":"CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.","status":"published","published":"2026-07-08T22:18:13.846Z","modified":"2026-07-10T03:55:38.395Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-311","CWE-523"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-42471","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.","status":"published","published":"2026-07-08T22:18:13Z","modified":"2026-07-10T03:55:38Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:03.742277Z"}],"ghsa":[{"id":"GHSA-2288-8h3r-cqgg","title":"CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality","description":"### Impact\nWhen the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT.\n\n#### Preconditions\nUsing security mode TransportWithMessageCredential with client credential type Windows, along with session establishment (which triggers use of WS-SecureConversation).\n\n### Patches\nFixed in CoreWCF v1.9.1\n\n### Workarounds\nEnsure communication is protected by SSL/TLS to prevent capturing of SCT negotiation handshake.","status":"published","published":"2026-06-19T20:47:17Z","modified":"2026-06-19T20:47:18Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-311","CWE-523"],"updated_at":"2026-11-02T14:40:31.656952Z"}],"nvd":[{"id":"CVE-2026-54784","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.","status":"published","published":"2026-07-08T23:16:56.307Z","modified":"2026-07-10T05:16:37.763Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-311","CWE-523"],"updated_at":"2026-11-02T14:12:28.4135Z"}],"osv":[{"id":"CVE-2026-54784","title":"CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality","description":"CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.","status":"published","published":"2026-07-08T22:18:13.846Z","modified":"2026-10-28T02:30:39.065174913Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-311","CWE-523"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-2288-8h3r-cqgg","title":"CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality","description":"### Impact\nWhen the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT.\n\n#### Preconditions\nUsing security mode TransportWithMessageCredential with client credential type Windows, along with session establishment (which triggers use of WS-SecureConversation).\n\n### Patches\nFixed in CoreWCF v1.9.1\n\n### Workarounds\nEnsure communication is protected by SSL/TLS to prevent capturing of SCT negotiation handshake.","status":"published","published":"2026-06-19T20:47:17Z","modified":"2026-06-19T21:11:29.162057Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-311","CWE-523"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}