CVE-2026-54774 PUBLISHED

CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

Assigner: GitHub_M
Reserved: 15.06.2026 Published: 08.07.2026 Updated: 09.07.2026

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token, allowing an attacker to reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This issue is fixed in versions 1.8.1 and 1.9.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	CoreWCF
Product	CoreWCF
Versions	Version >= 1.9.0, < 1.9.1 is affected Version < 1.8.1 is affected

References

Problem Types

CWE-345: Insufficient Verification of Data Authenticity CWE
CWE-347: Improper Verification of Cryptographic Signature CWE