CVE-2026-54779Medium· 5.9▾ SunlitCoreWCF: SAML token replay protection is inoperative
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.
Fixed in CoreWCF v1.8.1 and v1.9.1
Provide your own implementation of ITokenReplayCache with the correct behavior.
CoreWCF.Primitives < 1.8.1CoreWCF.Primitives >= 1.9.0, < 1.9.1Upgrade to a patched release:
CoreWCF.Primitives 1.8.1CoreWCF.Primitives 1.9.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54783High· 7.4CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
CVE-2026-54773Medium· 5.9CoreWCF: WS-Security signature substitution via document-wide Signature lookup
CVE-2026-54774High· 7.4CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
CVE-2026-54780Low· 3.7CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
CVE-2026-54781High· 7.4CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
CVE-2026-54782Critical· 10.0CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation