https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:18:40.036474+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335516 EUVD-2026-335516 2026-10-06T20:18:40.183422+00:00 EUVD-2026-335516 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54782 fkie_cve-2026-54782 2026-10-06T20:18:40.183459+00:00

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.

 https://cve.radiocsirt.org/vuln/ghsa-xjr9-gg9q-jx3v GHSA-xjr9-gg9q-jx3v — CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation 2026-10-06T20:18:40.183492+00:00

Affected: NuGet: CoreWCF.Primitives

### Impact Full impersonation of any principal the trusted STS could have issued an assertion for — including administrative principals when the relying party grants them via SAML claims. Affects both SAML 1.1 and SAML 2.0.

#### Preconditions Relying-party service is hosted with WSFederationHttpBinding or WS2007FederationHttpBinding (or any binding that triggers FederatedSecurityTokenManager for issued-token validation), and IdentityConfiguration is wired (UseIdentityConfiguration = true). Attacker can reach the service over the network and knows the trusted STS’s public certificate (public certs are by design discoverable).

### Patches Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds None