Executive brief
CoreWCF, a library used to build web services in .NET, contains a security flaw in how it validates identity tokens. An attacker could bypass security checks by providing a specially crafted identity assertion that the system incorrectly trusts without proper proof. This could allow an unauthorized user to impersonate a legitimate user and gain access to protected data or operations.
Technical details
A vulnerability exists in CoreWCF's SamlSecurityTokenHandler where SubjectConfirmationMethod URIs and holder-of-key proof keys are not strictly enforced. Specifically, the handler does not verify that incoming assertions belong to the SAML 1.1 defined set, nor does it require the <SubjectConfirmation><KeyInfo> element for holder-of-key assertions. An attacker can exploit this by providing an assertion with a fabricated confirmation method or no proof key, which the system treats as a bearer token. This allows the attacker to authenticate as a subject without proving authority over the assertion. The issue is resolved in versions 1.8.1 and 1.9.1 by validating that methods are restricted to the SAML 1.1 trio (bearer, sender-vouches, holder-of-key) and ensuring holder-of-key subjects carry a valid KeyInfo.
Affected products
- CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1
Timeline
- 2026-06-16: patched: Fixed in versions 1.8.1 and 1.9.1
- 2026-07-08: advisory: NVD publication date
References
- https://github.com/CoreWCF/CoreWCF/commit/6a99df3242f54acd6f89edfd6050430b72d0c685
- https://github.com/CoreWCF/CoreWCF/commit/86dd3232b6b8aaf32281be9e8d798afad6145d58
- https://github.com/CoreWCF/CoreWCF/commit/9eb9b46d1c2af06fb71f656a02f4d5b4649c1f03
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1
- https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1
- https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-48pq-2xq3-c2m4