CVE-2026-54780: CoreWCF WS-Security Digest Algorithm Bypass

Technical summary

The vulnerability exists in CoreWCF's WS-Security 1.0 receive pipeline. When processing digitally signed SOAP messages, the implementation validates the ds:SignedInfo SignatureMethod field against the configured SecurityAlgorithmSuite to ensure only approved signing algorithms are used. However, it does not validate the DigestMethod attribute on each ds:Reference element, which specifies the hash algorithm applied to individual message parts before signing. An attacker can craft a signed message where the overall signature uses an approved algorithm but individual digest operations use rejected algorithms such as SHA-1, which the message validation will accept. This violates the principle of algorithm whitelisting and creates a cryptographic weakening pathway. The flaw is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-757 (Selection of Less-Secure Weaker Cryptographic Algorithm during Negotiation).

Business impact

Organizations relying on CoreWCF for WCF service interoperability in .NET Core environments face integrity risk. If an attacker gains a network position between clients and the service—or compromises a trusted intermediary—they could inject or modify message content while maintaining a valid signature, provided they can exploit the digest algorithm bypass. The practical impact depends on message sensitivity; high-value transactions, configuration directives, or authentication tokens transmitted via WCF are at elevated risk. Services handling sensitive data should treat this as a medium-priority issue despite the low CVSS, because the attack requires both network access and knowledge of the service's message format, but successful exploitation leaves no cryptographic evidence of tampering.

Affected systems

CoreWCF versions prior to 1.8.1 and 1.9.1 are affected. CoreWCF is used in .NET Core and .NET 5+ applications that implement WCF service endpoints. Organizations should inventory services using CoreWCF and determine which versions are deployed. Check NuGet package references and runtime version metadata. Services on .NET Framework using the native WCF stack are not affected; the vulnerability is specific to the CoreWCF port.

Exploitability

Exploitation requires network access to the service and the ability to craft valid WS-Security SOAP messages, making the attack complexity high. An attacker must understand the service's message schema and have the capability to intercept or originate traffic to the endpoint. Successful exploitation does not yield confidentiality breaches (messages remain encrypted if transport-layer TLS is in use, though the vulnerability itself is at the application layer). However, once positioned to send crafted messages, an attacker can tamper with content in ways that cryptographic validation will not detect. The threat is real but not trivial; this is not an easily weaponizable remote code execution or denial-of-service vector.

Remediation

Upgrade CoreWCF to version 1.8.1 or 1.9.1 or later. These releases enforce validation of the DigestMethod on each ds:Reference element. After patching, verify that the SecurityAlgorithmSuite configuration in your application specifies only strong algorithms (e.g., SHA-256 or higher); do not configure SHA-1 or weaker algorithms as acceptable. Test patched services with your existing clients to ensure compatibility. If you cannot upgrade immediately, consider restricting network access to WCF endpoints to trusted clients only and using mutual authentication to reduce the window of attack.

Patch guidance

Patches are available in CoreWCF versions 1.8.1 and 1.9.1. Consult the official CoreWCF release notes and the vendor's security advisory for the exact timing and dependencies of these releases. Update via NuGet Package Manager: use `Update-Package CoreWCF -Version 1.9.1` (or the 1.8.x line if you are on an older minor version). After updating, rebuild and redeploy your service, then run integration tests to confirm that legitimate client traffic is not disrupted. Verify that your SecurityAlgorithmSuite configuration is not accidentally allowing weak algorithms.

Detection guidance

Monitor CoreWCF service logs and WS-Security validation events for messages that pass signature validation despite using unexpected digest algorithms. Enable detailed WCF tracing if available in your environment. Review incoming SOAP messages for ds:Reference elements with DigestMethod values set to SHA-1 or other weak algorithms; these should not appear if your SecurityAlgorithmSuite is properly configured. Use a Web Application Firewall or message inspection tool to flag WS-Security SOAP traffic containing legacy digest algorithms. Correlate any such detections with authentication and message-source information to identify potential tampering attempts.

Why prioritize this

Although rated LOW severity, this vulnerability warrants prompt attention because it undermines cryptographic integrity controls in message-oriented protocols where tampering detection is critical. The CVSS score reflects the limited reach (high attack complexity, no confidentiality impact) but does not capture the severity of successful exploitation in a business context. Prioritize patching for services handling sensitive transactions, authentication, or configuration data. For low-risk services, a standard patching window is acceptable, but do not defer indefinitely.

Risk score, explained

The CVSS v3.1 score of 3.7 (LOW) reflects the combination of network accessibility, high attack complexity, no confidentiality impact, low integrity impact (a single message can be tampered with, but not all messages or system state), and no availability impact. The score penalizes the requirement for an attacker to be positioned on the network and to understand the message format. However, CVSS does not fully account for the cryptographic assurance violation; an organization that depends on WCF message signatures for compliance or fraud prevention may experience a higher business risk than the numeric score suggests. Treat this as a contextual priority rather than a purely numeric one.

Frequently asked questions