CVE-2026-54773Medium· 5.9▾ SunlitCoreWCF: WS-Security signature substitution via document-wide Signature lookup
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.4%
An unauthenticated remote attacker who can place a SOAP header lexically before wsse:Security can embed a ds:Signature of their choosing inside that header and cause the server to verify the attacker-supplied signature instead of the one carried in the security header.
Exploitation requires the endpoint be configured with an endorsing supporting token binding, and the attacker constructs a ds:Signature whose KeyInfo resolves through the receive-side token resolver to a key under the attacker’s control. Both are conditions outside the attacker’s direct control on a generic deployment.
Fixed in CoreWCF v1.8.1 and v1.9.1
Use a security token resolver that only accepts references to issuer-pinned X.509 chains (the default when expecting a static set of signing certificates).
CoreWCF.Primitives < 1.8.1CoreWCF.Primitives >= 1.9.0, < 1.9.1Upgrade to a patched release:
CoreWCF.Primitives 1.8.1CoreWCF.Primitives 1.9.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54774High· 7.4CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
CVE-2026-54782Critical· 10.0CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
CVE-2026-54783High· 7.4CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
CVE-2026-54779Medium· 5.9CoreWCF: SAML token replay protection is inoperative
CVE-2026-54780Low· 3.7CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
CVE-2026-54781High· 7.4CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced