CVE-2026-54774High· 7.4▾ TwilightCoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.2%
When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.
The service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s <KeyInfo> - for example a BinarySecretSecurityToken representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.
Fixed in CoreWCF v1.8.1 and v1.9.1
None
CoreWCF.Primitives < 1.8.1CoreWCF.Primitives >= 1.9.0, < 1.9.1Upgrade to a patched release:
CoreWCF.Primitives 1.8.1CoreWCF.Primitives 1.9.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54783High· 7.4CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
CVE-2026-54773Medium· 5.9CoreWCF: WS-Security signature substitution via document-wide Signature lookup
CVE-2026-54781High· 7.4CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
CVE-2026-54782Critical· 10.0CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
CVE-2026-54779Medium· 5.9CoreWCF: SAML token replay protection is inoperative
CVE-2026-54780Low· 3.7CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass