CVE-2026-54774: CoreWCF SAML signature bypass in SamlSerializer

CVE-2026-54774 · Severity: high · CVSS 7.4 · Published 2026-07-08

CoreWCF, a tool used to run Windows Communication Foundation services on modern .NET platforms, contains a security flaw in how it verifies digital signatures for SAML identity tokens. When a service is configured to use certain types of security keys, an attacker can bypass the signature check by providing a forged token. This could allow an unauthorized user to impersonate others or gain elevated access to the service and its data.

Technologies: CoreWCF, CoreWCF.Primitives (NuGet). Vendors: CoreWCF, NuGet.

Quick answers

Is CVE-2026-54774 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54774 being exploited in the wild.
How severe is CVE-2026-54774?
High severity, with a CVSS score of 7.4, published 8 July 2026.
Which products and versions are affected?
CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1; CoreWCF.Primitives (NuGet) ECOSYSTEM:introduced=0,fixed=1.8.1.
Is there a fix for CVE-2026-54774?
Yes. CoreWCF.Primitives (NuGet): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54774 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54774?
Check whether you run CoreWCF or CoreWCF.Primitives (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • CoreWCF.Primitives (NuGet): upgrade to 1.8.1 or later
    dotnet add package CoreWCF.Primitives --version 1.8.1

Technical details

A vulnerability exists in CoreWCF's SamlSerializer.ReadToken method where signature verification logic branches based on the token type. While X509SecurityTokens undergo full XML-DSig verification, other token types (such as symmetric proof-keys used in WS-Trust scenarios) only trigger a digest-only verification of the SignedInfo block. This root cause allows an attacker to author a SAML assertion, compute the Reference DigestValue, and provide an arbitrary SignatureValue that is never cryptographically validated against a key. The issue is reachable when using WSSecurityTokenSerializer with an out-of-band issuer-token resolver containing non-X.509 tokens. The vulnerability is fixed in versions 1.8.1 and 1.9.1 by ensuring full key-based verification for all supported security key types.

Affected products

  • CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

Identifiers

  • CVE-2026-54774
  • GHSA-rpj7-hr7h-w6p9

Timeline

  • 2026-07-08: disclosed
  • 2026-07-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.