CVE-2026-54781

HIGH 7.4

CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced

CVSS Score

7.4

EPSS Score

0.2%

EPSS Percentile

8th

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion. This issue is fixed in versions 1.8.1 and 1.9.1.

CWE	CWE-287 CWE-345
Vendor	corewcf
Product	corewcf
Published	Jul 8, 2026
Last Updated	Jul 9, 2026

Stay Ahead of the Next One

Get instant alerts for corewcf corewcf

Be the first to know when new high vulnerabilities affecting corewcf corewcf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

CoreWCF / CoreWCF

>= 1.9.0, < 1.9.1 < 1.8.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-48pq-2xq3-c2m4 github.com: https://github.com/CoreWCF/CoreWCF/commit/6a99df3242f54acd6f89edfd6050430b72d0c685 github.com: https://github.com/CoreWCF/CoreWCF/commit/86dd3232b6b8aaf32281be9e8d798afad6145d58 github.com: https://github.com/CoreWCF/CoreWCF/commit/9eb9b46d1c2af06fb71f656a02f4d5b4649c1f03 github.com: https://github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1 github.com: https://github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1