CVE-2026-54781 Details
Description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion. This issue is fixed in versions 1.8.1 and 1.9.1.
A vulnerability exists in CoreWCF versions prior to 1.8.1 and 1.9.1, where the SAML token validation process in the SamlSecurityTokenHandler does not properly enforce the SubjectConfirmation method URIs or the holder-of-key proof keys. This oversight allows assertions with fabricated confirmation method URIs or without the required proof keys to be accepted, leading to unauthorized authentication of subjects. The issue arises when services are configured to accept SAML 1.1 tokens via federation, particularly with bindings that do not enforce strict validation of confirmation methods.
Users can upgrade to CoreWCF versions 1.8.1 or 1.9.1, both of which include the necessary validation enforcement for SAML SubjectConfirmation methods and holder-of-key proof keys.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CoreWCF/CoreWCF/commit/6a99df3242f54acd6f89edfd6050430b72d0c685 | [email protected] | Source CodeVendor |
| https://github.com/CoreWCF/CoreWCF/commit/86dd3232b6b8aaf32281be9e8d798afad6145d58 | [email protected] | Source CodeVendor |
| https://github.com/CoreWCF/CoreWCF/commit/9eb9b46d1c2af06fb71f656a02f4d5b4649c1f03 | [email protected] | Source CodeVendor |
| https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 | [email protected] | Release NotesVendor |
| https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1 | [email protected] | Release NotesVendor |
| https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-48pq-2xq3-c2m4 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CoreWCF | 1.8.0 (semver) 1.9.0 (semver) |
CPE
Remediation
| |
| CoreWCF.ConfigurationManager | All versions |
CPE
Remediation
| |
| CoreWCF.Http | All versions |
CPE
Remediation
| |
| CoreWCF.Kafka | All versions |
CPE
Remediation
| |
| CoreWCF.Kafka.Client | All versions |
CPE
Remediation
| |
| CoreWCF.MSMQ | All versions |
CPE
Remediation
| |
| CoreWCF.NetFramingBase | All versions |
CPE
Remediation
| |
| CoreWCF.NetNamedPipe | All versions |
CPE
Remediation
| |
| CoreWCF.NetTcp | All versions |
CPE
Remediation
| |
| CoreWCF.Primitives | All versions |
CPE
Remediation
| |
| CoreWCF.Queue | All versions |
CPE
Remediation
| |
| CoreWCF.RabbitMQ | All versions |
CPE
Remediation
| |
| CoreWCF.RabbitMQ.Client | All versions |
CPE
Remediation
| |
| CoreWCF.Templates | All versions |
CPE
Remediation
| |
| CoreWCF.UnixDomainSocket | All versions |
CPE
Remediation
| |
| CoreWCF.WebHttp | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |