Most recent entries from all

EUVD-2026-335518

fkie_cve-2026-54774

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token, allowing an attacker to reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This issue is fixed in versions 1.8.1 and 1.9.1.

GHSA-rpj7-hr7h-w6p9 — CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate

Affected: NuGet: CoreWCF.Primitives

### Impact When a service is configured to validate SAML tokens using a method other than X.509 certificate signing, the final signature verification is skipped.

#### Preconditions The service is configured to authenticate using SAML tokens and an out of band token resolver (commonly the IssuerTokenResolver of IssuedTokenServiceCredential) holds a non-X.509 SecurityToken whose key identifier the attacker can reference in the assertion’s `<KeyInfo>` - for example a `BinarySecretSecurityToken` representing the symmetric proof key issued by a WS-Trust symmetric-key holder-of-key STS.

### Patches Fixed in CoreWCF v1.8.1 and v1.9.1

### Workarounds None