https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T17:45:57.589264+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-335517 EUVD-2026-335517 2026-10-06T17:45:57.592145+00:00 EUVD-2026-335517 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54784 fkie_cve-2026-54784 2026-10-06T17:45:57.592179+00:00

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.

 https://cve.radiocsirt.org/vuln/ghsa-2288-8h3r-cqgg GHSA-2288-8h3r-cqgg — CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality 2026-10-06T17:45:57.592210+00:00

Affected: NuGet: CoreWCF.Primitives

### Impact When the proof key recovered from the RSTR can be observed by a party that is not the legitimate client, that party can impersonate the authenticated Windows principal for the lifetime of the SCT (default ~10 hours) and decrypt or forge any subsequent WS‑SecureConversation traffic that uses keys derived from the SCT.

#### Preconditions Using security mode TransportWithMessageCredential with client credential type Windows, along with session establishment (which triggers use of WS-SecureConversation).

### Patches Fixed in CoreWCF v1.9.1

### Workarounds Ensure communication is protected by SSL/TLS to prevent capturing of SCT negotiation handshake.