CVE-2026-54783 PUBLISHED

CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages

Assigner: GitHub_M
Reserved: 15.06.2026 Published: 08.07.2026 Updated: 09.07.2026

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with one captured signed SOAP envelope to replay arbitrary service operations as the victim principal. This issue is fixed in versions 1.8.1 and 1.9.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 7.4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	CoreWCF
Product	CoreWCF
Versions	Version >= 1.9.0, < 1.9.1 is affected Version < 1.8.1 is affected

References

Problem Types

CWE-294: Authentication Bypass by Capture-replay CWE
CWE-345: Insufficient Verification of Data Authenticity CWE
CWE-347: Improper Verification of Cryptographic Signature CWE