CVE-2026-54783: CoreWCF WS-Security Signature Verification Bypass

Technical summary

The vulnerability exists in CoreWCF's implementation of WS-Security endorsing and supporting signature verification. When processing SOAP messages with digital signatures, the library fails to validate that the ds:Signature element properly covers (is scoped to) the intended Security header target. An attacker who captures a legitimately signed SOAP envelope can extract the signature and reapply it to a different SOAP operation request. Because the signature verification logic does not enforce that the signature is cryptographically bound to the specific operation being requested, the victim's credentials are improperly reused. This violates the principle that a signature should be operation-specific and non-transferable.

Business impact

Services built on vulnerable CoreWCF versions face a critical authentication bypass risk. An attacker intercepting any signed SOAP request (requiring only network-level access, not credential compromise) can impersonate the authenticated user to execute arbitrary operations. This could allow lateral movement within service-to-service communication architectures, unauthorized data modification, or invocation of sensitive business logic. The impact is particularly severe in environments where CoreWCF handles inter-service authentication or processes high-value transactions, as a single captured message enables repeated, unlogged privilege escalation.

Affected systems

CoreWCF versions prior to 1.8.1 and 1.9.1 are vulnerable. Any application using CoreWCF for WS-Security-protected SOAP endpoints is at risk. This primarily affects organizations that have migrated WCF services to .NET Core or built new distributed service architectures on CoreWCF. The vulnerability is version-dependent; verify your deployed CoreWCF version and cross-reference the vendor advisory for the exact affected range.

Exploitability

Exploitation requires network access to intercept SOAP traffic but does not require the attacker to possess valid credentials or break cryptographic primitives. The attack complexity is rated as High in the CVSS vector, likely reflecting that the attacker must first capture a legitimate signed message; however, once obtained, reuse is trivial. No user interaction is needed, and the signature can be replayed across multiple operations. This is a practical attack vector in any environment where SOAP messages traverse untrusted networks or where an attacker has positioned themselves for traffic sniffing.

Remediation

Upgrade CoreWCF to version 1.8.1 or later if running the 1.8.x branch, or to version 1.9.1 or later if running the 1.9.x branch. Review the vendor's release notes to confirm signature verification logic has been corrected to enforce proper scoping of signatures to their intended Security header targets. After patching, redeploy affected services and validate that signature verification is now enforcing operation-level binding.

Patch guidance

Consult the CoreWCF project's official release notes and security advisories for the exact patched versions and any migration considerations. Versions 1.8.1 and 1.9.1 contain the fix; confirm your target version aligns with your supported branch. Test patches in a staging environment to ensure compatibility with your service's WS-Security configuration and existing signed message handling. If you are on a version older than 1.8.x, determine whether you can upgrade to 1.8.1+ or must move to the 1.9.x branch, and plan accordingly.

Detection guidance

Monitor WCF service logs and network traffic for repeated SOAP requests using identical signature values but different operation names or payloads—this pattern indicates potential signature reuse. Implement network-based detection rules to flag SOAP messages where the signature timestamp or nonce appears reused across multiple distinct operations. Review WS-Security audit logs to identify scenarios where a single authenticated identity invokes multiple different operations in rapid succession with identical signature metadata. Consider deploying a WAF or API gateway rule to reject SOAP requests where signature binding appears incorrect or inconsistent with the operation being requested.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.4) and the combination of high integrity and confidentiality impact with network exploitability. The flaw directly undermines the security of message-level authentication in distributed service architectures. Any organization relying on WS-Security for inter-service trust should treat this as a critical priority, as a single captured message can enable persistent privilege escalation and is difficult to detect in real time. The lack of KEV listing does not diminish its severity; it reflects the current lack of observed active exploitation, not the technical risk.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects: (1) Network attack vector—no physical proximity required; (2) High attack complexity due to the need to intercept a signed message first, but straightforward reuse once obtained; (3) No privilege escalation required from the attacker; (4) High confidentiality and integrity impact—the attacker can execute arbitrary operations as a legitimate user; (5) No availability impact. The score appropriately captures a serious authentication bypass that does not require credential theft but does require message interception, making it a moderate-to-high practical threat depending on network defensibility.

Frequently asked questions