High severityNVD Advisory· Published Jun 19, 2026· Updated Jun 19, 2026
CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate
CVE-2026-54774
Description
Impact
When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.
Preconditions
The service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s ` - for example a BinarySecretSecurityToken` representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.
Patches
Fixed in CoreWCF v1.8.1 and v1.9.1
Workarounds
None
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
CoreWCF.PrimitivesNuGet | < 1.8.1 | 1.8.1 |
CoreWCF.PrimitivesNuGet | >= 1.9.0, < 1.9.1 | 1.9.1 |
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
1- CoreWCF: 13 CVEs Disclosed in a Single Day — Critical SAML Bypass and WS-Security FlawsVypr Intelligence · Jun 19, 2026