What is the CVSS score of CVE-2026-54774?

CVE-2026-54774 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of CoreWCF are affected by CVE-2026-54774?

CoreWCF (versions prior to 1.8.1 and version 1.9.0) contains a SAML signature bypass vulnerability (CVE-2026-54774) with no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-54774?

Within 24 hours: Identify and inventory all systems running CoreWCF, prioritizing applications handling authentication or sensitive transactions. Within 7 days: Upgrade CoreWCF to version 1.8.1 or version 1.9.1 and later (excluding 1.9.0); verify patches applied across all instances. Within 30 days: Conduct comprehensive audit of SAML assertion validation logic and review authentication logs from the past 90 days for anomalous assertion patterns.

CoreWCF CVE-2026-54774

HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-06-19 https://github.com/CoreWCF/CoreWCF

GHSA-rpj7-hr7h-w6p9

Denial Of Service

7.4

CVSS 3.1 · Vendor: https://github.com/CoreWCF/CoreWCF

Severity by source

Vendor (https://github.com/CoreWCF/CoreWCF) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable SAML endpoint (AV:N), no auth needed because the bug bypasses auth (PR:N), high complexity due to required non-X.509 STS configuration and known key identifier (AC:H); impersonation yields C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/CoreWCF/CoreWCF).

CVSS VectorVendor: https://github.com/CoreWCF/CoreWCF

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 21:30 vuln.today

Analysis Generated

Jun 19, 2026 - 21:30 vuln.today

DescriptionCVE.org

Impact

When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.

Preconditions

The service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s <KeyInfo> - for example a BinarySecretSecurityToken representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

AnalysisAI

SAML token signature bypass in CoreWCF (versions <1.8.1 and 1.9.0) allows remote attackers to forge authenticated SAML assertions when the service validates tokens via a non-X.509 signing method. The SamlSerializer silently skips the final SignatureValue verification step, enabling assertion tampering and authentication bypass against WS-Trust holder-of-key configurations using symmetric proof keys. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-rpj7-hr7h-w6p9) confirms the issue and patches are available.

Technical ContextAI

CoreWCF is the community port of Windows Communication Foundation to .NET Core, providing SOAP/WS-* service hosting including WS-Security and WS-Trust. The flaw lives in SamlSerializer's signature verification path: when a SAML assertion's <KeyInfo> references a non-X.509 SecurityToken resolved out-of-band by an IssuerTokenResolver (such as a BinarySecretSecurityToken representing a symmetric proof key from a WS-Trust symmetric-key holder-of-key STS), the code returns before invoking the final SignatureValue cryptographic check. This is a CWE-345 (Insufficient Verification of Data Authenticity) defect - the signature element is parsed and the key is resolved, but the cryptographic comparison that proves the signature was produced by the holder of the key is bypassed entirely, breaking the SAML trust model.

RemediationAI

Vendor-released patch: upgrade CoreWCF.Primitives to 1.8.1 (for the 1.8.x branch) or 1.9.1 (for the 1.9.x branch) as published in GHSA-rpj7-hr7h-w6p9 (https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-rpj7-hr7h-w6p9). The advisory explicitly states no workarounds are available, so patching is the only supported mitigation; if upgrading must be delayed, operationally restrict SAML authentication to X.509-certificate-signed tokens by reconfiguring IssuedTokenServiceCredential to avoid out-of-band non-X.509 issuer token resolvers - this avoids the vulnerable code path but breaks WS-Trust symmetric-key holder-of-key flows and any federation that depends on BinarySecretSecurityToken-style proof keys. Auditing service authentication logs for unexpected SAML assertions and tightening network access to the SOAP endpoint can reduce exposure window pending the upgrade.