CVE-2026-54784: CoreWCF SPNEGO Proof Key Exposure and Session Hijacking

Technical summary

The vulnerability exists in CoreWCF's implementation of SPNEGO SecurityContextToken negotiation when TransportWithMessageCredential is combined with Windows client credentials and session establishment. The proof key material derived from the RequestSecurityTokenResponse (RSTR) is not properly protected during the negotiation handshake, exposing it to passive network observation. An attacker capable of observing network traffic can extract this key and use it to decrypt subsequent WS-SecureConversation traffic and forge messages as the authenticated principal. The issue is rooted in improper cryptographic material handling (CWE-311) and exposure of sensitive information in log files or debug data (CWE-523).

Business impact

Organizations relying on CoreWCF 1.9.0 for Windows-authenticated service-to-service communication face a critical session hijacking risk. An attacker with network-level visibility (internal network, compromised ISP, cloud provider positioning, or man-in-the-middle capability) can impersonate legitimate authenticated principals, leading to unauthorized data access, modification of transactions, and potential lateral movement within service architectures. The impact is particularly severe in line-of-business applications handling sensitive transactions or accessing restricted data, and in multi-tenant cloud scenarios where tenants should be isolated.

Affected systems

CoreWCF version 1.9.0 is affected. Version 1.9.1 and later contain the fix. Any .NET Core or .NET 5+ application using CoreWCF for Windows-authenticated WCF services with TransportWithMessageCredential binding and session management is vulnerable. This includes legacy WCF services being modernized to .NET Core, enterprise service buses, and API gateway implementations relying on CoreWCF for Windows authentication and message-level security.

Exploitability

Exploitation requires network-level access to observe the SPNEGO negotiation traffic (CVSS Attack Vector: Network, but with High complexity due to the need for a specific configuration pattern and session context). The attacker must be able to capture the RSTR message during session establishment and extract the proof key. Once obtained, exploiting the compromise is straightforward—decrypting and forging subsequent messages requires no interaction and no privileges. The configuration requirement (TransportWithMessageCredential + Windows credentials + session) limits the scope but remains common in enterprise environments.

Remediation

Upgrade CoreWCF to version 1.9.1 or later immediately. If immediate patching is not feasible, restrict network access to CoreWCF service endpoints to trusted internal networks only, isolate services behind network segmentation, and consider using alternative authentication mechanisms (e.g., certificate-based, mutual TLS) that do not rely on SPNEGO negotiation. Monitor for indicators of proof key extraction or unusual session activity on affected services.

Patch guidance

Apply the upgrade to CoreWCF 1.9.1 as published by the project maintainers. Verify compatibility with your application's .NET Core/.NET version before deployment. The fix is isolated to the security token negotiation layer and should not require application code changes. Test the upgrade in a non-production environment to confirm service stability before rolling out to production. For large deployments, plan a phased rollout to minimize service interruption.

Detection guidance

Search for CoreWCF package references in your codebase and dependency manifests; identify any usage with TransportWithMessageCredential binding and Windows authentication. Monitor runtime logs for SPNEGO negotiation activity and session establishment patterns. Network-based detection is difficult without decrypting SPNEGO traffic; focus on identifying outdated CoreWCF versions in your environment via package scanning, software inventory tools, and SCA (Software Composition Analysis) platforms. Track for unusual session persistence or forged message signatures that deviate from expected authentication patterns.

Why prioritize this

This is a HIGH severity vulnerability affecting authentication and confidentiality of secure service communication. The proof key exposure allows complete session hijacking and message forgery, violating both confidentiality (C:H) and integrity (I:H) in the CVSS vector. While the attack vector is Network, the requirement for session-based configuration and network positioning raises the attack complexity. However, the combination of high impact and the likelihood that many enterprises use CoreWCF for Windows-authenticated services makes this a priority for rapid patching. The absence from the KEV catalog does not diminish the need for prompt remediation—it reflects early-stage disclosure rather than lack of risk.

Risk score, explained

The CVSS 3.1 score of 7.4 (HIGH) reflects high impact on confidentiality and integrity of encrypted communications, network-based attack vector, and no authentication requirement. The attack complexity is rated high because the vulnerability requires a specific binding configuration (TransportWithMessageCredential with Windows credentials and session establishment), limiting the scope of vulnerable instances. The score appropriately penalizes the lack of availability impact (session hijacking does not cause denial of service). For organizations with widespread CoreWCF usage in sensitive authentication contexts, the practical risk may exceed the numerical score.

Frequently asked questions