CVE-2026-54781: CoreWCF improper authentication in SAML SamlSecurityTokenHandler

CVE-2026-54781 · Severity: high · CVSS 7.4 · Published 2026-07-08

CoreWCF, a library used to build web services in .NET, contains a security flaw in how it validates identity tokens. An attacker could bypass security checks by providing a specially crafted identity assertion that the system incorrectly trusts without proper proof. This could allow an unauthorized user to impersonate a legitimate user and gain access to protected data or operations.

Technologies: CoreWCF, CoreWCF.Primitives (NuGet). Vendors: CoreWCF, NuGet.

Quick answers

Is CVE-2026-54781 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54781 being exploited in the wild.
How severe is CVE-2026-54781?
High severity, with a CVSS score of 7.4, published 8 July 2026.
Which products and versions are affected?
CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1; CoreWCF.Primitives (NuGet) ECOSYSTEM:introduced=0,fixed=1.8.1.
Is there a fix for CVE-2026-54781?
Yes. CoreWCF.Primitives (NuGet): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54781 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54781?
Check whether you run CoreWCF or CoreWCF.Primitives (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • CoreWCF.Primitives (NuGet): upgrade to 1.8.1 or later
    dotnet add package CoreWCF.Primitives --version 1.8.1

Technical details

A vulnerability exists in CoreWCF's SamlSecurityTokenHandler where SubjectConfirmationMethod URIs and holder-of-key proof keys are not strictly enforced. Specifically, the handler does not verify that incoming assertions belong to the SAML 1.1 defined set, nor does it require the <SubjectConfirmation><KeyInfo> element for holder-of-key assertions. An attacker can exploit this by providing an assertion with a fabricated confirmation method or no proof key, which the system treats as a bearer token. This allows the attacker to authenticate as a subject without proving authority over the assertion. The issue is resolved in versions 1.8.1 and 1.9.1 by validating that methods are restricted to the SAML 1.1 trio (bearer, sender-vouches, holder-of-key) and ensuring holder-of-key subjects carry a valid KeyInfo.

Affected products

  • CoreWCF CoreWCF < 1.8.1, >= 1.9.0 < 1.9.1

Identifiers

  • CVE-2026-54781
  • GHSA-48pq-2xq3-c2m4

Timeline

  • 2026-06-16: patched: Fixed in versions 1.8.1 and 1.9.1
  • 2026-07-08: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.