---
id: CVE-2026-54784
title: 'CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality'
summary: 'CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality'
severity: high
cvss: 7.4
cwe:
  - CWE-311
  - CWE-523
vendor: CoreWCF
product: CoreWCF.Primitives
ecosystem: nuget
affected:
  - 'CoreWCF.Primitives >= 1.9.0, < 1.9.1'
patched:
  - CoreWCF.Primitives 1.9.1
published: '2026-06-19'
updated: '2026-06-19'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2288-8h3r-cqgg'
references:
  - url: 'https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-2288-8h3r-cqgg'
  - url: 'https://github.com/advisories/GHSA-2288-8h3r-cqgg'
tags:
  - ghsa
  - nuget
ingestedAt: '2026-06-22T13:35:24.418Z'
epss: 0.00272
epssPercentile: 0.17478
---

## Overview

### Impact
When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT.

#### Preconditions
Using security mode TransportWithMessageCredential with client credential type Windows, along with session establishment (which triggers use of WS-SecureConversation).

### Patches
Fixed in CoreWCF v1.9.1

### Workarounds
Ensure communication is protected by SSL/TLS to prevent capturing of SCT negotiation handshake.

## Affected packages

- `CoreWCF.Primitives >= 1.9.0, < 1.9.1`

## Remediation

Upgrade to a patched release:

- `CoreWCF.Primitives 1.9.1`