CVE-2026-54774: CoreWCF Auth Bypass Vulnerability

CVE-2026-54774 Overview

CVE-2026-54774 is a signature verification bypass vulnerability in CoreWCF, the .NET Core port of the service side of Windows Communication Foundation (WCF). The SamlSerializer component skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token. An attacker can reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This allows forged SAML assertions to be accepted as valid, undermining authentication and authorization decisions built on top of SAML. The issue is fixed in CoreWCF 1.8.1 and 1.9.1, and is tracked as [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
A remote attacker can forge SAML assertions accepted by a CoreWCF service, leading to authentication bypass and impersonation of trusted identities.

Affected Products

CoreWCF versions prior to 1.8.1 (1.8.x branch)
CoreWCF versions prior to 1.9.1 (1.9.x branch)
.NET services that consume SAML tokens through CoreWCF SamlSerializer with non-X.509 signing tokens

Discovery Timeline

2026-07-08 - CVE-2026-54774 published to NVD
2026-07-08 - Last updated in NVD database
CoreWCF v1.8.1 and v1.9.1 - Patched releases published on GitHub

Technical Details for CVE-2026-54774

Vulnerability Analysis

The defect lives in src/CoreWCF.Primitives/src/CoreWCF/IdentityModel/Tokens/SamlSerializer.cs. When the signing token referenced by a SAML assertion is an X.509 certificate, CoreWCF invokes the full signature validation path. When the referenced token is any other SecurityToken type, the code path calls assertion.Signature.SignedInfo.Verify(...). That call only validates the SignedInfo element's digest reference computation, not the outer SignatureValue cryptographic verification. The SignatureValue, which binds SignedInfo to the signing key, is never checked. As a result, an attacker who can submit SAML tokens with an arbitrary SecurityKeyIdentifier pointing to a non-X.509 token can present forged assertions whose signatures do not match the referenced key.

Root Cause

The root cause is an incomplete signature verification routine that treats SignedInfo.Verify as equivalent to full XML Digital Signature validation. SignedInfo.Verify recomputes reference digests but does not cryptographically verify SignatureValue against the signing key. Combined with an under-validated key identifier resolution path for non-X.509 tokens, this allows assertions to be accepted without proof of possession of the signing key [CWE-345].

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker crafts a SAML assertion referencing a non-X.509 SecurityToken key identifier, submits it to a CoreWCF endpoint that accepts SAML-based authentication, and the service validates the assertion despite an invalid or attacker-chosen signature. Attack complexity is elevated because the target endpoint must be configured to accept SAML tokens backed by non-X.509 signing tokens.

text

// Patch excerpt from SamlSerializer.cs
// Source: https://github.com/CoreWCF/CoreWCF/commit/65d09022749854ba943e376aefb958dec05b00d8
            }
            else
            {
-                assertion.Signature.SignedInfo.Verify(Microsoft.IdentityModel.Tokens.CryptoProviderFactory.Default);
+                Microsoft.IdentityModel.Tokens.SecurityKey msVerificationKey = TryCreateMicrosoftIdentityVerificationKey(verificationKey);
+                if (msVerificationKey == null)
+                {
+                    throw new SecurityTokenException(SR.Format(SR.SamlSignatureVerificationKeyNotSupported, verificationKey?.GetType().FullName ?? "null"));
+                }
+
+                var cryptoProviderFactory = new CoreWCF.Security.Sha1CryptoProviderFactory();
+                msVerificationKey.CryptoProviderFactory = cryptoProviderFactory;
+                try
+                {
+                    assertion.Signature.Verify(msVerificationKey, cryptoProviderFactory);
+                }
+                catch (Microsoft.IdentityModel.Xml.XmlValidationException xve)
+                {
+                    if (xve.Message.Contains("SignatureMethod is not supported"))
+                    {
+                        throw new SecurityTokenException(SR.Format(SR.SignatureMethodNotSupported, assertion.Signature.SignedInfo.SignatureMethod), xve);
+                    }
+
+                    throw;
+                }
            }

The fix replaces SignedInfo.Verify with assertion.Signature.Verify(msVerificationKey, cryptoProviderFactory), which performs full signature validation against a resolved verification key. See the CoreWCF security patch commit for the complete diff.

Detection Methods for CVE-2026-54774

Indicators of Compromise

SAML assertions arriving at CoreWCF endpoints with SecurityTokenReference elements pointing to non-X.509 key identifier types
Successful authentications where the SignatureValue element does not cryptographically match the referenced signing key
Unusual identity claims or subject values in SAML assertions from previously unseen issuers

Detection Strategies

Inventory .NET services that reference the CoreWCF.Primitives package below versions 1.8.1 or 1.9.1 using SBOM or NuGet lockfile scans
Enable verbose WCF and CoreWCF trace logging to capture SamlSerializer token validation events and correlate signing token types with assertion outcomes
Deploy application-layer inspection that flags SAML tokens whose KeyInfo references non-X.509 tokens on endpoints where X.509 is the expected signing material

Monitoring Recommendations

Alert on authentication successes originating from SAML assertions with unexpected KeyIdentifier types
Monitor CoreWCF service logs for spikes in SAML token validation followed by privileged operations
Track outbound calls and downstream actions performed under identities established via SAML to detect impersonation-driven lateral movement

How to Mitigate CVE-2026-54774

Immediate Actions Required

Upgrade CoreWCF to 1.8.1 (for 1.8.x deployments) or 1.9.1 (for 1.9.x deployments) immediately
Audit CoreWCF endpoints that accept SAML tokens and restrict issuers to trusted, X.509-backed identity providers
Rotate credentials and re-validate active sessions established through SAML authentication on affected services

Patch Information

CoreWCF maintainers released fixed versions v1.8.1 and v1.9.1. The fix is described in GitHub Security Advisory GHSA-rpj7-hr7h-w6p9 and implemented across commits 65d0902, b914495, and e745413. Update the CoreWCF.Primitives NuGet package and any dependent CoreWCF packages to the fixed versions.

Workarounds

Disable SAML-based authentication on CoreWCF endpoints until patched versions can be deployed
Enforce policy that only X.509 certificate-backed SAML signing tokens are accepted, rejecting all other SecurityToken key identifier types at the application layer
Terminate SAML validation at an upstream identity gateway that performs full XML Digital Signature validation before requests reach CoreWCF

bash

# Update CoreWCF to a patched version
dotnet add package CoreWCF.Primitives --version 1.9.1
dotnet add package CoreWCF.Http --version 1.9.1

# Verify installed versions
dotnet list package | grep -i corewcf