CVE-2026-54779: CoreWCF SAML Token Replay Protection Bypass

Technical summary

The vulnerability exists in the DefaultTokenReplayCache.TryAdd method of CoreWCF versions prior to 1.8.1 and 1.9.1. When DetectReplayedTokens is configured to true, the replay cache fails to detect and reject duplicate SAML tokens. The TryAdd operation does not perform proper duplicate detection, meaning a previously-cached token can be added again without triggering a rejection. This breaks the replay protection contract and allows tokens to be reused indefinitely, violating the intended one-time-use semantics of SAML authentication tokens.

Business impact

Token replay attacks can lead to unauthorized access to protected resources and services. An attacker with a captured SAML token can impersonate legitimate users without needing credentials or re-authentication. In environments where SAML tokens are long-lived or carry sensitive permissions, this creates a persistent authentication bypass. The impact is especially severe in multi-tenant or federated identity scenarios where a single token compromise could affect multiple integrated systems.

Affected systems

CoreWCF versions prior to 1.8.1 (1.8.0 and earlier) and 1.9.0 are affected. The vulnerability only manifests when the DetectReplayedTokens security feature is explicitly enabled. Applications using CoreWCF for SAML-based authentication with replay detection active are at risk. Note that this affects the open-source CoreWCF project; verify your dependency tree to confirm exposure.

Exploitability

Exploitation requires network access and a captured or intercepted SAML token, making the attack vector network-based but with elevated complexity due to the need to obtain a valid token first. No authentication or user interaction is required once a token is obtained. The attack is deterministic once preconditions are met—there is no race condition or timing sensitivity. The CVSS score of 5.9 (MEDIUM) reflects the integrity impact (unauthorized access) against the constraint that a token must first be captured.

Remediation

Upgrade CoreWCF to version 1.8.1 or later if using the 1.8.x branch, or to version 1.9.1 or later if using the 1.9.x branch. These versions restore proper duplicate detection in the token replay cache. If immediate patching is not possible, disable SAML token processing or review whether DetectReplayedTokens can be temporarily disabled, though this reduces security posture and is not recommended as a permanent workaround.

Patch guidance

Apply the security update to CoreWCF by updating your NuGet package reference to version 1.8.1 or 1.9.1 (or later). Review your project dependencies to ensure all direct and transitive references to vulnerable CoreWCF versions are updated. Verify compatibility with your application after patching, though these are maintenance releases and should not introduce breaking changes. For teams using a corporate NuGet feed, work with package management to stage and validate the update before broad deployment.

Detection guidance

Monitor for repeated use of the same SAML token in authentication logs or token validation events, especially if tokens appear in different sessions or contexts. Examine CoreWCF configuration to confirm DetectReplayedTokens is enabled; if it is not set explicitly, verify the default behavior in your version. Review audit logs for suspicious patterns such as the same token appearing in multiple authentication events within a short time window. Consider instrumenting the DefaultTokenReplayCache to log cache hits and misses.

Why prioritize this

This vulnerability enables persistent authentication bypass for SAML-based services. The combination of network-accessible attack surface and integrity-level impact (unauthorized access) justifies prompt patching. While the CVSS score is MEDIUM, the nature of the flaw—defeating a security control that is often explicitly enabled for compliance reasons—elevates its practical priority. Organizations relying on SAML federation for access control should treat this as high-priority.

Risk score, explained

CVSS 5.9 reflects network accessibility (AV:N) and integrity impact (I:H) without requiring authentication or user interaction. The elevated complexity (AC:H) accounts for the attacker needing to first capture a valid token. The lack of confidentiality or availability impact limits the score to MEDIUM. However, the qualitative risk is elevated for organizations where SAML tokens are a critical authentication trust anchor.

Frequently asked questions