{"id":"CVE-2026-54774","title":"CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate","summary":"CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate","severity":"high","cvss":7.4,"cwe":["CWE-345","CWE-347"],"vendor":"CoreWCF","product":"CoreWCF.Primitives","ecosystem":"nuget","affected":["CoreWCF.Primitives < 1.8.1","CoreWCF.Primitives >= 1.9.0, < 1.9.1"],"patched":["CoreWCF.Primitives 1.8.1","CoreWCF.Primitives 1.9.1"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-rpj7-hr7h-w6p9","references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-rpj7-hr7h-w6p9"},{"url":"https://github.com/advisories/GHSA-rpj7-hr7h-w6p9"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T13:35:24.439Z","epss":0.00203,"epssPercentile":0.09031,"slug":"CVE-2026-54774","body":"## Overview\n\n### Impact\nWhen a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.\n\n#### Preconditions\nThe service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s `<KeyInfo>` - for example a `BinarySecretSecurityToken` representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nNone\n\n## Affected packages\n\n- `CoreWCF.Primitives < 1.8.1`\n- `CoreWCF.Primitives >= 1.9.0, < 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `CoreWCF.Primitives 1.8.1`\n- `CoreWCF.Primitives 1.9.1`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}