CVE-2026-54782CWE-290CWE-347

CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation

Critical · published July 8, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00414 · 34.6th percentile
Weaknesses
CWE-290 · Authentication Bypass by Spoofing; CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-07-08T22:20Z
EPSS history
Timeline
  • 08 JUL 22:20Z
    CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
    cvelistv5