PT-2026-51079 · Nuget · Corewcf.Primitives

Published 2026-06-19 · Updated 2026-06-19 · CVE-2026-54782

OSV

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Impact

Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.

Preconditions

Relying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true). Attacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).

Patches

Fixed in CoreWCF v1.8.1 and v1.9.1

Workarounds

None

Fix

Improper Verification of Cryptographic Signature

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-347

CWE-290

Related Identifiers

CVE-2026-54782

GHSA-XJR9-GG9Q-JX3V

Affected Products

Corewcf.Primitives

References · 3

• https://osv.dev/vulnerability/GHSA-xjr9-gg9q-jx3v · Vendor Advisory
• https://github.com/CoreWCF/CoreWCF · Note
• https://github.com/CoreWCF/CoreWCF/security/advisories/GHSA-xjr9-gg9q-jx3v · Note