CVE-2026-54781CWE-287CWE-345

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

High · published July 8, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
15.2
In the wild
Unconfirmed
What it is

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion. This issue is fixed in versions 1.8.1 and 1.9.1.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00248 · 15.2th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-07-08T22:19Z
EPSS history
Timeline
  • 08 JUL 22:19Z
    CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
    cvelistv5