---
id: CVE-2026-54774
title: >-
  CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing
  token is not an X.509 certificate
summary: >-
  CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing
  token is not an X.509 certificate
severity: high
cvss: 7.4
cwe:
  - CWE-345
  - CWE-347
vendor: CoreWCF
product: CoreWCF.Primitives
ecosystem: nuget
affected:
  - CoreWCF.Primitives < 1.8.1
  - 'CoreWCF.Primitives >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.Primitives 1.8.1
  - CoreWCF.Primitives 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-rpj7-hr7h-w6p9'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-rpj7-hr7h-w6p9'
  - url: 'https://github.com/advisories/GHSA-rpj7-hr7h-w6p9'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.439Z'
epss: 0.00203
epssPercentile: 0.09031
---

## Overview

### Impact
When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.

#### Preconditions
The service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s `<KeyInfo>` - for example a `BinarySecretSecurityToken` representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.

### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds
None

## Affected packages

- `CoreWCF.Primitives < 1.8.1`
- `CoreWCF.Primitives >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.Primitives 1.8.1`
- `CoreWCF.Primitives 1.9.1`