CoreWCF CVE-2026-54783
HIGH
GHSA-gqv6-pwcg-87r8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-exploitable once an envelope is captured (AV:N), capture prerequisite raises AC:H, no privileges or interaction needed; full confidentiality and integrity impact via impersonation, no availability effect.
Primary rating from Vendor (https://github.com/CoreWCF/CoreWCF).
CVSS VectorVendor: https://github.com/CoreWCF/CoreWCF
Lifecycle Timeline
2DescriptionCVE.org
Impact
The attacker, with one captured signed SOAP envelope from a victim and no other privileges, can invoke arbitrary operations on the service as the victim principal for the lifetime of the captured signing key. There is no rate limit on replays. The DetectReplays setting on transport-security bindings does not mitigate the issue because the attack does not reuse the original timestamp - the fresh timestamp in the wsse:Security header is what the replay-detection logic inspects.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
Ensure communication is protected by SSL/TLS to prevent capturing of signed SOAP envelope.
AnalysisAI
Authentication bypass via XML Signature Wrapping in CoreWCF allows attackers who capture a single signed SOAP envelope to replay arbitrary operations as the victim principal for the lifetime of the signing key. The flaw affects CoreWCF.Primitives versions below 1.8.1 and the 1.9.0 line below 1.9.1, defeating the DetectReplays mitigation because the attacker forges a fresh wsse:Security timestamp rather than reusing the original. No public exploit identified at time of analysis, but the vendor advisory (GHSA-gqv6-pwcg-87r8) provides sufficient technical detail to reproduce.
Technical ContextAI
CoreWCF is the community port of Windows Communication Foundation to .NET Core, providing SOAP/WS-* services on modern .NET. The vulnerability is in the WS-Security endorsing/supporting signature verification path within CoreWCF.Primitives, where signed message elements can be relocated within the SOAP envelope (XML Signature Wrapping) and combined with a freshly minted wsse:Security timestamp. CWE-294 (Authentication Bypass by Capture-Replay) is the root cause class: signature verification still succeeds against the captured key material, but the replay-detection logic only inspects the new timestamp the attacker generates, so messages bypass DetectReplays even when transport-security bindings enable it.
RemediationAI
Vendor-released patch: upgrade CoreWCF.Primitives to 1.8.1 on the 1.8.x branch or to 1.9.1 on the 1.9.x branch per advisory GHSA-gqv6-pwcg-87r8 (https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-gqv6-pwcg-87r8). Where immediate patching is not possible, enforce SSL/TLS for all SOAP communication so that signed envelopes cannot be passively captured on the wire - note this only mitigates network-based capture and does not protect against captures from logs, proxies, or compromised intermediaries. Additionally, shorten signing-key lifetimes and rotate any keys suspected of having sent messages over unencrypted channels, since the replay window equals the key validity period.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today