Critical severity10.0NVD Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-54782
CVE-2026-54782
Description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
CoreWCF.PrimitivesNuGet | < 1.8.1 | 1.8.1 |
CoreWCF.PrimitivesNuGet | >= 1.9.0, < 1.9.1 | 1.9.1 |
Affected products
1Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-xjr9-gg9q-jx3vghsaADVISORY
- github.com/CoreWCF/CoreWCF/security/advisories/GHSA-xjr9-gg9q-jx3vnvdWEB
- github.com/CoreWCF/CoreWCF/commit/0b8c8af851260e85e8402af53233d1b8f87dfb6fnvd
- github.com/CoreWCF/CoreWCF/commit/0e63c2cca55763d8be6b226a234579280a09e7b6nvd
- github.com/CoreWCF/CoreWCF/commit/e5cc9b6a4ecc102a50d782093bfc72e0790abe3dnvd
- github.com/CoreWCF/CoreWCF/releases/tag/v1.8.1nvd
- github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1nvd
News mentions
1- CoreWCF: 13 CVEs Disclosed in a Single Day — Critical SAML Bypass and WS-Security FlawsVypr Intelligence · Jun 19, 2026