---
id: CVE-2026-54782
title: >-
  CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature
  validation
summary: >-
  CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature
  validation
severity: critical
cvss: 10
cwe:
  - CWE-290
  - CWE-347
vendor: CoreWCF
product: CoreWCF.Primitives
ecosystem: nuget
affected:
  - CoreWCF.Primitives < 1.8.1
  - 'CoreWCF.Primitives >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.Primitives 1.8.1
  - CoreWCF.Primitives 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-xjr9-gg9q-jx3v'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-xjr9-gg9q-jx3v'
  - url: 'https://github.com/advisories/GHSA-xjr9-gg9q-jx3v'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.422Z'
epss: 0.00414
epssPercentile: 0.33062
---

## Overview

### Impact
Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.

#### Preconditions
Relying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true).
Attacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).

### Patches
Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds
None

## Affected packages

- `CoreWCF.Primitives < 1.8.1`
- `CoreWCF.Primitives >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.Primitives 1.8.1`
- `CoreWCF.Primitives 1.9.1`