CVE-2026-54781: CoreWCF SAML Token Validation Bypass (Holder-of-Key Downgrade)

Technical summary

The SamlSecurityTokenHandler in CoreWCF fails to properly validate SubjectConfirmation method URIs and holder-of-key proof keys during SAML token processing. The vulnerability stems from insufficient enforcement of confirmation method constraints and proof-of-possession requirements. An attacker can exploit this by presenting a SAML assertion with a downgraded or custom SubjectConfirmation method, bypassing the cryptographic proof checks that should validate the subject's authority over the token. The flaw allows authentication to succeed even when the attacker cannot demonstrate control of the signing key material. Root causes align with CWE-287 (improper authentication) and CWE-345 (insufficient verification of data authenticity).

Business impact

Organizations using CoreWCF for SAML-based service authentication face elevated risk of account compromise. An attacker who obtains a SAML token—through network interception, insider access, or third-party compromise—can reuse or modify it to impersonate users without being detected by proof-of-possession validation. This could lead to unauthorized access to backend services, lateral movement within integrated systems, and potential data exfiltration. The impact is particularly acute in zero-trust or federated identity scenarios where SAML token strength is a core security boundary.

Affected systems

CoreWCF versions prior to 1.8.1 (1.8.x line) and prior to 1.9.1 (1.9.x line) are affected. CoreWCF is commonly used in .NET Core and .NET 5+ environments where WCF-style service contracts are being modernized. Any application using CoreWCF's SAML token handler for service-to-service or client-to-service authentication is in scope. Organizations should inventory deployments across on-premises, hybrid, and cloud environments where CoreWCF processes SAML assertions.

Exploitability

The CVSS score of 7.4 (HIGH) reflects a network-accessible vulnerability with high complexity barriers (AC:H), suggesting exploitation requires non-trivial preconditions or detailed knowledge of the target's SAML configuration. However, the vulnerability does not require user interaction or elevated privileges, making it practical for attackers who can craft or intercept SAML tokens. Real-world exploitation likelihood depends on the attacker's ability to obtain valid SAML tokens and understanding of the relying party's expected SubjectConfirmation methods. The flaw is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but the technical accessibility and high impact make it a prioritized remediation target.

Remediation

Upgrade CoreWCF to version 1.8.1 or later (for the 1.8.x branch) or version 1.9.1 or later (for the 1.9.x branch). The fixed versions enforce strict validation of SubjectConfirmation method URIs and require cryptographic proof of key possession for holder-of-key assertions. Organizations should verify patch application in lower environments first, then schedule coordinated upgrades across production infrastructure, accounting for any custom SAML configurations or dependent service contracts.

Patch guidance

1. Identify all applications and services using CoreWCF in your environment by scanning project files for nuget package references to CoreWCF. 2. Audit which versions are currently deployed; prioritize 1.8.x and 1.9.x branches. 3. Update nuget package references to CoreWCF 1.8.1 or 1.9.1 (or later stable versions in those branches). 4. Recompile and test applications in a pre-production environment, paying special attention to SAML token issuance and validation flows. 5. Review any custom SubjectConfirmation handling or SAML configuration overrides that may interact with the patched validation logic. 6. Deploy to production on a schedule that minimizes service disruption; coordinate with identity provider teams if applicable.

Detection guidance

1. Log and monitor SAML token validation failures and warnings in CoreWCF-based applications; look for patterns of rejected tokens followed by successful authentications with modified SubjectConfirmation methods. 2. Inspect SAML token contents in-flight (where feasible) to detect anomalous or unexpected SubjectConfirmation methods. 3. Monitor authentication events for tokens originating from unexpected issuers or with mismatched confirmation method/key bindings. 4. Review audit logs for successful authentications preceded by validation errors, which could indicate downgrade exploitation. 5. Implement application-level assertions that verify SubjectConfirmation method matches expected policy before accepting the token.

Why prioritize this

This is a high-severity authentication bypass vulnerability in a security-critical component (SAML token validation). The attack does not require user interaction or elevated privileges, and the impact spans confidentiality and integrity of authenticated sessions. Although not yet in active exploitation in the wild, the technical clarity of the flaw and its role in foundational identity processing warrants immediate patching, especially for any organization using CoreWCF in production for service authentication or federation scenarios.

Risk score, explained

CVSS 7.4 (HIGH) reflects the combination of network reachability, high authentication impact (confidentiality and integrity), and the need for elevated attacker capability or system knowledge (AC:H). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N captures that an unauthenticated attacker can reach the service, but must overcome higher complexity (e.g., obtaining a valid SAML token, crafting a valid assertion) to exploit the flaw. No denial of service impact is present. The absence of a KEV listing does not diminish urgency; internal corporate risk models should weight this as critical-to-high depending on reliance on SAML-based authentication.

Frequently asked questions