Vulnerability Report

CVE-2026-54782

Title: CoreWCF SAML Token Validation Bypass

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-54782.

CWE Category CWE-290

Published Date Jul 08, 2026

Modified Date Jul 10, 2026

Exploit Status Not Found

Score 10.0 CVSS v3.1

Exploit Probability (EPSS)

0.25%

Vulnerability Summary

CVE-2026-54782: CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.

Impacted Vendors

Analysis in Progress...

Reference Links

https://github.com/CoreWCF/CoreWCF/commit/0b8c8af851260e85e8402af53233d1b8f87dfb6f https://github.com/CoreWCF/CoreWCF/commit/0e63c2cca55763d8be6b226a234579280a09e7b6 https://github.com/CoreWCF/CoreWCF/commit/e5cc9b6a4ecc102a50d782093bfc72e0790abe3d https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1 https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-xjr9-gg9q-jx3v

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

10.0

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-54782 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

July 10, 2026 MODIFIED

Vulnerability data updated via NVD.

July 09, 2026 MODIFIED

Vulnerability data updated via NVD.

July 08, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected Stack

No specific products linked.