CVE-2026-54774: CoreWCF SAML Signature Verification Bypass – HIGH Severity

Technical summary

The vulnerability exists in CoreWCF's SamlSerializer when processing SAML assertions signed with non-X.509 SecurityTokens. During token validation, the SignatureValue verification step is conditionally skipped if the signing token is not X.509-based. An attacker can exploit this by crafting a SAML assertion that references a non-X.509 key identifier in the signature block, causing the validator to bypass final signature verification entirely. The flaw affects versions prior to 1.8.1 and 1.9.1. CWE-345 (Insufficient Verification of Data Authenticity) and CWE-347 (Improper Verification of Cryptographic Signature) are the root causes.

Business impact

Services relying on CoreWCF for SAML token validation with non-X.509 signing credentials face a direct authentication bypass risk. An attacker can forge valid-looking SAML assertions without possessing the actual signing key, gaining unauthorized access to protected resources or assuming the identity of legitimate users. The impact is particularly severe in multi-tenant or federated identity scenarios where token trust is foundational to access control and audit trails.

Affected systems

CoreWCF versions prior to 1.8.1 and 1.9.1 are vulnerable. The issue specifically manifests when a CoreWCF service is configured to validate SAML tokens using non-X.509 signing credentials. Organizations using CoreWCF for WCF service migration to .NET Core should assess their token validation configuration and signing token types immediately.

Exploitability

Exploitation requires network access to a vulnerable service and the ability to craft a SAML assertion with a non-X.509 key reference. The attack is not trivial—an attacker needs understanding of SAML structure and the target service's expected token format—but the lack of cryptographic verification means the barrier to crafting a valid-appearing token is substantially lowered. CVSS 7.4 (HIGH) reflects the high confidentiality and integrity impact but higher complexity and network-only attack vector.

Remediation

Upgrade CoreWCF to version 1.8.1 or 1.9.1, depending on your current track. Verify against the vendor advisory for your specific deployment version. If immediate upgrade is not feasible, consider migrating to X.509-based signing credentials for SAML validation, which does not exhibit this code path. Review and strengthen token validation logging to detect anomalous assertions.

Patch guidance

Apply CoreWCF security updates to reach version 1.8.1 (for the 1.8.x line) or 1.9.1 (for the 1.9.x line) as soon as feasible. Both versions contain the fix for SamlSerializer SignatureValue verification. After patching, restart all services using CoreWCF and validate that token validation behavior has not been altered by the update. Monitor service logs for any validation errors during the transition period.

Detection guidance

Monitor CoreWCF service logs for SAML token validation warnings or exceptions. Look for patterns of assertions with non-X.509 key references being processed by your services. Network detection is challenging without decryption, but tools monitoring SAML assertion structure on ingress may flag assertions with inconsistent signing token references. Consider enabling enhanced logging in CoreWCF configuration to capture token metadata during validation for post-incident forensics.

Why prioritize this

This is a HIGH-severity authentication bypass affecting a widely-used service framework. Any service using CoreWCF for SAML validation with non-X.509 credentials faces direct compromise risk. The simplicity of exploitation once a vulnerable configuration is identified makes this a priority target for threat actors seeking persistent access. It should be patched ahead of lower-complexity issues.

Risk score, explained

CVSS 7.4 reflects HIGH severity due to complete bypass of signature verification (high impact to confidentiality and integrity of authentication), network accessibility, and lack of user interaction required. The 'High Complexity' component acknowledges that exploitation requires crafting a properly-structured SAML token, but the absence of cryptographic validation significantly reduces the actual barrier. The 'No Availability Impact' component recognizes this is an authentication attack, not a denial-of-service.

Frequently asked questions