CVE-2026-54773: CoreWCF WS-Security Signature Verification Bypass

Technical summary

CoreWCF's WS-Security implementation performs document-wide XPath searches for ds:Signature elements without proper scope constraints. When WSSecurityOneDotZeroReceiveSecurityHeader processes inbound messages, it retrieves the first signature found in the document rather than specifically validating the signature contained within the wsse:Security header. An attacker can prepend a crafted SOAP header containing a valid signature over attacker-controlled data, causing the verification logic to validate this attacker-supplied signature instead of the intended security header signature. The vulnerability requires HTTP network access but no authentication; however, successful exploitation depends on the attacker's ability to influence message structure and timing (hence the High complexity rating).

Business impact

Services relying on WS-Security for message integrity and non-repudiation face a complete bypass of signature validation. Attackers can forge messages, impersonate legitimate clients, and potentially trigger unauthorized transactions or state changes if the application trusts signed message content. The impact is confined to message integrity (CWE-347: Improper Verification of Cryptographic Signature); confidentiality is not affected. Industries using CoreWCF for SOAP-based integrations—financial services, healthcare, and legacy system modernization—are most at risk.

Affected systems

CoreWCF versions prior to 1.8.1 and all 1.9.x versions before 1.9.1 are affected. This includes any .NET Core or .NET 5+ application that uses CoreWCF's WS-Security binding to handle inbound SOAP messages. Applications not using WS-Security or those already updated to 1.8.1 or 1.9.1 are unaffected.

Exploitability

Exploitation requires network access and the ability to send crafted SOAP messages to a vulnerable CoreWCF endpoint. No authentication is needed. The attacker complexity is rated as High, primarily because successful exploitation depends on message structure and the application's processing logic. Public exploit code is not known, and weaponized proof-of-concept availability is not documented. Reliable exploitation would likely require detailed knowledge of the target application's message processing pipeline.

Remediation

Upgrade CoreWCF to version 1.8.1 or 1.9.1 or later. Both versions fix the signature verification scope issue by ensuring that only signatures within the wsse:Security header are validated. Organizations should verify the patch has been applied and validate message processing behavior post-upgrade, particularly for high-value or sensitive SOAP transactions.

Patch guidance

Review your CoreWCF dependency version in project files and package manifests. If you are on 1.8.x, upgrade to 1.8.1 or later; if on 1.9.0, upgrade to 1.9.1 or later. Consult the CoreWCF release notes and vendor advisory for any breaking changes or deprecation notices. Test patched applications thoroughly in a staging environment that mirrors production SOAP message patterns before deploying to production. Verify that message signing and verification still function as expected with existing client and service integrations.

Detection guidance

Monitor CoreWCF application logs for unexpected signature validation failures or warnings related to WS-Security processing. Inspect inbound SOAP messages for headers that appear before wsse:Security tags in violation of expected message structure. Network-based detection is challenging without deep SOAP parsing, but organizations can correlate CoreWCF version inventory with vulnerability databases. Consider enabling detailed WCF diagnostics and message logging in development and test environments to observe signature verification paths.

Why prioritize this

Although rated MEDIUM (CVSS 5.9), this vulnerability directly undermines message authentication, a foundational security property for SOAP-based service communication. Organizations using CoreWCF for sensitive inter-service or client-service communication should prioritize patching. The attack requires no authentication and only moderate complexity, making it accessible to determined threat actors. Priority should be highest for systems handling financial transactions, identity assertions, or confidential data exchanges.

Risk score, explained

The CVSS 3.1 score of 5.9 reflects Network reachability (AV:N), High complexity (AC:H), no authentication required (PR:N), no user interaction (UI:N), and Integrity impact (I:H) with no Confidentiality or Availability impact. The High complexity accounts for the need to craft valid message structure and timing. The score does not account for business context; organizations using WS-Security for critical authentication or authorization decisions should treat this as higher risk operationally.

Frequently asked questions