{"id":"CVE-2026-54773","title":"CoreWCF: WS-Security signature substitution via document-wide Signature lookup","summary":"CoreWCF: WS-Security signature substitution via document-wide Signature lookup","severity":"medium","cvss":5.9,"cwe":["CWE-347"],"vendor":"CoreWCF","product":"CoreWCF.Primitives","ecosystem":"nuget","affected":["CoreWCF.Primitives < 1.8.1","CoreWCF.Primitives >= 1.9.0, < 1.9.1"],"patched":["CoreWCF.Primitives 1.8.1","CoreWCF.Primitives 1.9.1"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-jc6x-rj79-w4mx","references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-jc6x-rj79-w4mx"},{"url":"https://github.com/advisories/GHSA-jc6x-rj79-w4mx"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T13:35:24.442Z","epss":0.0037,"epssPercentile":0.30843,"slug":"CVE-2026-54773","body":"## Overview\n\n### Impact\nAn unauthenticated remote attacker who can place a SOAP header lexically before `wsse:Security` can embed a `ds:Signature` of their choosing inside that header and cause the server to verify the attacker-supplied signature instead of the one carried in the security header.\n\n#### Preconditions\nExploitation requires the endpoint be configured with an endorsing supporting token binding, and the attacker constructs a `ds:Signature` whose `KeyInfo` resolves through the receive-side token resolver to a key under the attacker’s control. Both are conditions outside the attacker’s direct control on a generic deployment.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nUse a security token resolver that only accepts references to issuer-pinned X.509 chains (the default when expecting a static set of signing certificates).\n\n## Affected packages\n\n- `CoreWCF.Primitives < 1.8.1`\n- `CoreWCF.Primitives >= 1.9.0, < 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `CoreWCF.Primitives 1.8.1`\n- `CoreWCF.Primitives 1.9.1`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}