CVE-2026-54779: CoreWCF SAML token replay protection bypass in DefaultTokenReplayCache

CVE-2026-54779 · Severity: medium · CVSS 5.9 · Published 2026-07-08

CoreWCF, a library used to build web services on .NET Core, contains a flaw where security tokens can be reused by an attacker. Although the software has a setting to prevent 'replay attacks,' a bug in the underlying code fails to actually block duplicate tokens. This could allow an unauthorized user to capture a legitimate login token and reuse it to gain access to the service.

Technologies: CoreWCF, CoreWCF.Primitives (NuGet). Vendors: CoreWCF, NuGet.

Quick answers

Is CVE-2026-54779 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54779 being exploited in the wild.
How severe is CVE-2026-54779?
Medium severity, with a CVSS score of 5.9, published 8 July 2026.
Which products and versions are affected?
CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1; CoreWCF.Primitives (NuGet) ECOSYSTEM:introduced=0,fixed=1.8.1.
Is there a fix for CVE-2026-54779?
Yes. CoreWCF.Primitives (NuGet): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54779 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54779?
Check whether you run CoreWCF or CoreWCF.Primitives (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • CoreWCF.Primitives (NuGet): upgrade to 1.8.1 or later
    dotnet add package CoreWCF.Primitives --version 1.8.1

Technical details

A vulnerability exists in CoreWCF's SAML token validation logic where the 'DetectReplayedTokens' setting is ineffective. The root cause is in the 'DefaultTokenReplayCache.TryAdd' implementation, which unconditionally returns true even if a token key is already present in the cache. This bypasses the replay check performed by the inner Microsoft.IdentityModel.Tokens.Saml handler. An attacker who captures a valid SAML token can successfully replay it against the service to gain unauthorized access. The fix replaces the MemoryCache backing with a ConcurrentDictionary and ensures 'TryAdd' correctly identifies and rejects existing keys. This issue is resolved in versions 1.8.1 and 1.9.1.

Affected products

  • CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

Identifiers

  • CVE-2026-54779
  • GHSA-9jr3-rj99-8jq3

Timeline

  • 2026-07-08: disclosed
  • 2026-07-08: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.