High severity7.4GHSA Advisory· Published Jul 8, 2026· Updated Jul 10, 2026
CVE-2026-54784
CVE-2026-54784
Description
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
CoreWCF.PrimitivesNuGet | >= 1.9.0, < 1.9.1 | 1.9.1 |
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-2288-8h3r-cqggghsaADVISORY
- github.com/CoreWCF/CoreWCF/security/advisories/GHSA-2288-8h3r-cqggnvdWEB
- github.com/CoreWCF/CoreWCF/commit/2afae08b2fa5288428df89e8161116b816cf6b4bnvd
- github.com/CoreWCF/CoreWCF/commit/f216aa6929d41dc99cee098b1e69c260ec4c41c7nvd
- github.com/CoreWCF/CoreWCF/releases/tag/v1.9.1nvd
News mentions
1- CoreWCF: 13 CVEs Disclosed in a Single Day — Critical SAML Bypass and WS-Security FlawsVypr Intelligence · Jun 19, 2026