Security Flaw in CoreWCF SAML Validation for .NET Core by CoreWCF
CVE-2026-54781

7.4HIGH

Key Information:

Vendor

Corewcf

Status
Corewcf
Vendor
CVE Published:
8 July 2026

What is CVE-2026-54781?

CoreWCF, a port of the Windows Communication Foundation to .NET Core, has a vulnerability in its SAML token validation mechanism. This flaw allows for potential authentication bypass through unsecured subject confirmation method URIs and holder-of-key proof keys. As a result, malicious actors could exploit this vulnerability to authenticate a subject without proper verification of authority over the assertion. This issue has been rectified in updates 1.8.1 and 1.9.1. Users are strongly encouraged to update their CoreWCF installations to secure their applications.

Affected Version(s)

CoreWCF >= 1.9.0, < 1.9.1 < 1.9.0, 1.9.1

CoreWCF < 1.8.1 < 1.8.1

References

https://github.com/CoreWCF/CoreWCF/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/CoreWCF/CoreWCF/commit/6a99df3242f54ac...
x_refsource_MISC
https://github.com/CoreWCF/CoreWCF/commit/86dd3232b6b8aaf...
x_refsource_MISC

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.