---
id: CVE-2026-54779
title: 'CoreWCF: SAML token replay protection is inoperative'
summary: 'CoreWCF: SAML token replay protection is inoperative'
severity: medium
cvss: 5.9
cwe:
  - CWE-294
  - CWE-613
vendor: CoreWCF
product: CoreWCF.Primitives
ecosystem: nuget
affected:
  - CoreWCF.Primitives < 1.8.1
  - 'CoreWCF.Primitives >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.Primitives 1.8.1
  - CoreWCF.Primitives 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-9jr3-rj99-8jq3'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-9jr3-rj99-8jq3'
  - url: 'https://github.com/advisories/GHSA-9jr3-rj99-8jq3'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.428Z'
epss: 0.00434
epssPercentile: 0.35111
---

## Overview

### Impact
When enabling DetectReplayedTokens, a token can be replayed and will be detected despite it being reused.

### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds
Provide your own implementation of `ITokenReplayCache` with the correct behavior.

## Affected packages

- `CoreWCF.Primitives < 1.8.1`
- `CoreWCF.Primitives >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.Primitives 1.8.1`
- `CoreWCF.Primitives 1.9.1`