{"id":"CVE-2026-54779","title":"CoreWCF: SAML token replay protection is inoperative","summary":"CoreWCF: SAML token replay protection is inoperative","severity":"medium","cvss":5.9,"cwe":["CWE-294","CWE-613"],"vendor":"CoreWCF","product":"CoreWCF.Primitives","ecosystem":"nuget","affected":["CoreWCF.Primitives < 1.8.1","CoreWCF.Primitives >= 1.9.0, < 1.9.1"],"patched":["CoreWCF.Primitives 1.8.1","CoreWCF.Primitives 1.9.1"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9jr3-rj99-8jq3","references":[{"url":"https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-9jr3-rj99-8jq3"},{"url":"https://github.com/advisories/GHSA-9jr3-rj99-8jq3"}],"tags":["ghsa","nuget"],"ingestedAt":"2026-06-22T13:35:24.428Z","epss":0.00434,"epssPercentile":0.37108,"slug":"CVE-2026-54779","body":"## Overview\n\n### Impact\nWhen enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.\n\n### Patches\nFixed in CoreWCF v1.8.1 and v1.9.1\n\n### Workarounds\nProvide your own implementation of `ITokenReplayCache` with the correct behavior.\n\n## Affected packages\n\n- `CoreWCF.Primitives < 1.8.1`\n- `CoreWCF.Primitives >= 1.9.0, < 1.9.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `CoreWCF.Primitives 1.8.1`\n- `CoreWCF.Primitives 1.9.1`","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}